phpldapadmin/lib/server_functions.php
2009-06-30 21:51:50 +10:00

3211 lines
101 KiB
PHP

<?php
/* $Header: /cvsroot/phpldapadmin/phpldapadmin/lib/server_functions.php,v 1.51.2.7 2008/01/31 12:34:26 wurley Exp $ */
/**
* Classes and functions for LDAP server configuration and capability
*
* @author The phpLDAPadmin development team
* @package phpLDAPadmin
*/
/**
* @package phpLDAPadmin
*/
class LDAPserver {
/** Server ID as defined in config.php */
public $server_id;
/** Server Name as defined in config.php */
public $name;
/** Server Hostname as defined in config.php */
public $host;
/** Server Port as defined in config.php */
public $port;
/** Server Authentication method as defined in config.php */
public $auth_type;
/** Server Authentication Login DN as defined in config.php */
public $login_dn;
/** Server Authentication Password as defined in config.php */
public $login_pass;
/** Server Base Dn */
private $_baseDN = null;
/** Schema DN */
private $_schemaDN = null;
/** Raw Schema entries */
private $_schema_entries = null;
/** Our LDAP connections */
private $connection = array();
/** Last LDAP server operation */
private $lastop = null;
/** Default constructor.
* @param int $server_id the server_id of the LDAP server as defined in config.php
*/
function __construct($server_id) {
if (DEBUG_ENABLED)
debug_log('Entered with (%s)',17,__FILE__,__LINE__,__METHOD__,$server_id);
$this->server_id = $server_id;
}
/**
* Check if there is sufficent information to Authenticate to the LDAP server.
*
* Given a server, returns whether or not we have enough information
* to authenticate against the server. For example, if the user specifies
* auth_type of 'cookie' in the config for that server, it checks the $_COOKIE array to
* see if the cookie username and password is set for the server. If the auth_type
* is 'session', the $_SESSION array is checked. If the auth_type is 'http', the
* $_SERVER['PHP_AUTH_USER'] and $_SERVER['PHP_AUTH_PW'] is checked.
*
* There are three cases for this function depending on the auth_type configured for
* the specified server. If the auth_type is session or cookie or http, then getLoggedInDN()
* is called to verify that the user has logged in. If the auth_type is config, then the
* $ldapservers configuration in config.php is checked to ensure that the user has specified
* login information. In any case, if phpLDAPadmin has enough information to login
* to the server, true is returned. Otherwise false is returned.
*
* @return bool
* @see getLoggedInDN
*/
function haveAuthInfo() {
if (DEBUG_ENABLED) {
debug_log('Entered with ()',17,__FILE__,__LINE__,__METHOD__);
debug_log('We are a (%s) auth_type',80,__FILE__,__LINE__,__METHOD__,$this->auth_type);
}
# Set default return
$return = false;
# For session or cookie auth_types, we check the session or cookie to see if a user has logged in.
if (in_array($this->auth_type,array('session','cookie','http'))) {
/* we don't look at getLoggedInPass() cause it may be null for anonymous binds
* getLoggedInDN() will never return null if someone is really logged in. */
if ($this->getLoggedInDN())
$return = true;
else
$return = false;
/* whether or not the login_dn or pass is specified, we return
* true here. (if they are blank, we do an anonymous bind anyway) */
} elseif ($this->auth_type == 'config') {
$return = true;
} else {
error(sprintf(_('Error: You have an error in your config file. The only three allowed values for auth_type in the $servers section are \'session\', \'cookie\', and \'config\'. You entered \'%s\', which is not allowed.'),htmlspecialchars($this->auth_type)),'error',true);
}
if (DEBUG_ENABLED)
debug_log('Returning (%s)',17,__FILE__,__LINE__,__METHOD__,$return);
return $return;
}
/**
* Connect to the LDAP server.
*
* @param bool $process_error Whether to call an error page, if the connection fails
* @param bool $connect_id The ID for this connection
* @param bool $reconnect Use a cached connetion, or create a new one.
* @returns resource|false Connection resource to LDAP server, or false if no connection made.
*/
function connect($process_error=true,$connect_id='user',$reconnect=false,$readonly=true,$dn=null,$pass=null) {
global $CACHE;
if (DEBUG_ENABLED)
debug_log('Entered with (%s,%s,%s)',17,__FILE__,__LINE__,__METHOD__,
$process_error,$connect_id,$reconnect);
# Quick return if we have already connected.
if (isset($this->connection[$connect_id]['resource']) && ! $reconnect) {
if (DEBUG_ENABLED)
debug_log('Returning CACHED connection resource [%s](%s)',16,__FILE__,__LINE__,__METHOD__,
$this->connection[$connect_id]['resource'],$connect_id);
return $this->connection[$connect_id]['resource'];
}
# No identifiable connection exists, lest create a new one.
if (DEBUG_ENABLED)
debug_log('Creating new connection [%s] for Server ID [%s]',16,__FILE__,__LINE__,__METHOD__,
$connect_id,$this->server_id);
$this->connection[$connect_id]['resource'] = null;
# Grab the AUTH INFO based on the auth_type for this server
if ($connect_id == 'anonymous') {
if (DEBUG_ENABLED)
debug_log('This IS an anonymous login',80,__FILE__,__LINE__,__METHOD__);
$this->connection[$connect_id]['login_dn'] = null;
$this->connection[$connect_id]['login_pass'] = null;
} elseif ($this->auth_type == 'config') {
if (DEBUG_ENABLED)
debug_log('This IS a "config" login',80,__FILE__,__LINE__,__METHOD__);
if (! $this->login_dn) {
if (DEBUG_ENABLED)
debug_log('No login_dn for CONFIG auth_type, so well do anonymous',80,__FILE__,__LINE__,__METHOD__);
$connect_id = 'anonymous';
} else {
$this->connection[$connect_id]['login_dn'] = $this->login_dn;
$this->connection[$connect_id]['login_pass'] = $this->login_pass;
if (DEBUG_ENABLED)
debug_log('CONFIG auth_type settings, DN [%s], PASS [%s]',80,__FILE__,__LINE__,__METHOD__,
$this->connection[$connect_id]['login_dn'],
$this->connection[$connect_id]['login_pass'] ? md5($this->connection[$connect_id]['login_pass']) : '');
}
} else {
if (DEBUG_ENABLED)
debug_log('This IS some other login',80,__FILE__,__LINE__,__METHOD__);
# Did we pass the dn/pass to this function?
if ($dn) {
$this->connection[$connect_id]['login_dn'] = $dn;
$this->connection[$connect_id]['login_pass'] = $pass;
if (DEBUG_ENABLED)
debug_log('Login settings were passed to this function, DN [%s], PASS [%s]',80,__FILE__,__LINE__,__METHOD__,
$this->connection[$connect_id]['login_dn'],
$this->connection[$connect_id]['login_pass'] ? md5($this->connection[$connect_id]['login_pass']) : '');
# Was this an anonyous bind (the cookie stores 0 if so)?
} elseif ($this->getLoggedInDN() == 'anonymous') {
$connect_id = 'anonymous';
$this->connection[$connect_id]['login_dn'] = null;
$this->connection[$connect_id]['login_pass'] = null;
if (DEBUG_ENABLED)
debug_log('Already logged in as anonymous',80,__FILE__,__LINE__,__METHOD__);
} else {
$this->connection[$connect_id]['login_dn'] = $this->getLoggedInDN();
$this->connection[$connect_id]['login_pass'] = $this->getLoggedInPass();
if (DEBUG_ENABLED)
debug_log('Already logged in as DN [%s], PASS [%s]',80,__FILE__,__LINE__,__METHOD__,
$this->connection[$connect_id]['login_dn'],
$this->connection[$connect_id]['login_pass'] ? md5($this->connection[$connect_id]['login_pass']) : '');
}
}
# Work out if we are doing a SASL AUTH
if ($this->sasl_auth) {
$this->connection[$connect_id]['sasl_auth'] = true;
$this->connection[$connect_id]['sasl_mech'] = $this->sasl_mech;
$this->connection[$connect_id]['sasl_realm'] = $this->sasl_realm;
$this->connection[$connect_id]['sasl_authz_id'] = $this->sasl_authz_id;
$this->connection[$connect_id]['sasl_authz_id_regex'] = $this->sasl_authz_id_regex;
$this->connection[$connect_id]['sasl_authz_id_replacement'] = $this->sasl_authz_id_replacement;
$this->connection[$connect_id]['sasl_props'] = $this->sasl_props;
} else {
$this->connection[$connect_id]['sasl_auth'] = false;
}
if (DEBUG_ENABLED)
debug_log('Summary config settings, DN [%s], PASS [%s]',80,__FILE__,__LINE__,__METHOD__,
$this->connection[$connect_id]['login_dn'],
$this->connection[$connect_id]['login_pass'] ? md5($this->connection[$connect_id]['login_pass']) : '');
# Test if we have info to login.
if ($connect_id != 'anonymous' && ! $this->connection[$connect_id]['login_dn'] && ! $this->connection[$connect_id]['login_pass']) {
if (DEBUG_ENABLED)
debug_log('We dont have enough auth info for server [%s]',80,__FILE__,__LINE__,__METHOD__,$this->server_id);
return false;
}
# If we get here, we need to login - now figure out which server.
if (! $readonly) {
$host = $this->hostwr ? $this->hostwr : $this->host;
$port = $this->hostwr && $this->portwr ? $this->portwr : $this->port;
$connect_id = 'write';
} else {
$host = $this->host;
$port = $this->port;
}
# Our connect_id may have changed, lets just check and see if we have already connected.
if (isset($this->connection[$connect_id]['resource']) && ! $reconnect) {
if (DEBUG_ENABLED)
debug_log('Returning CACHED connection resource [%s](%s)',16,__FILE__,__LINE__,__METHOD__,
$this->connection[$connect_id]['resource'],$connect_id);
return $this->connection[$connect_id]['resource'];
}
run_hook('pre_connect',array('server_id'=>$this->server_id,'connect_id'=>$connect_id));
if ($port)
$resource = @ldap_connect($host,$port);
else
$resource = @ldap_connect($host);
if (DEBUG_ENABLED)
debug_log('LDAP Resource [%s], Host [%s], Port [%s]',16,__FILE__,__LINE__,__METHOD__,
$resource,$host,$port);
# Go with LDAP version 3 if possible (needed for renaming and Novell schema fetching)
@ldap_set_option($resource,LDAP_OPT_PROTOCOL_VERSION,3);
/* Disabling this makes it possible to browse the tree for Active Directory, and seems
* to not affect other LDAP servers (tested with OpenLDAP) as phpLDAPadmin explicitly
* specifies deref behavior for each ldap_search operation. */
@ldap_set_option($resource,LDAP_OPT_REFERRALS,0);
# Try to fire up TLS is specified in the config
if ($this->isTLSEnabled()) {
function_exists('ldap_start_tls') or error(_('Your PHP install does not support TLS.'),'error');
@ldap_start_tls($resource) or error(_('Could not start TLS. Please check your LDAP server configuration.'),'error',true);
}
$bind_result = false;
/**
* Implementation of SASL ldap_bind()
* This option requires PHP 5.x compiled with --with-ldap-sasl=DIR
*/
if (isset($this->connection[$connect_id]['sasl_auth']) &&
$this->connection[$connect_id]['sasl_auth'] == true) {
# No support for ldap_sasl_bind?
if (! function_exists('ldap_sasl_bind'))
error(_('Your PHP installation does not support ldap_sasl_bind() function. This function is present in PHP 5.x when compiled with --with-ldap-sasl.'),'error');
# Fill variables
$props = $this->connection[$connect_id]['sasl_props'];
$mech = $this->connection[$connect_id]['sasl_mech'];
$realm = $this->connection[$connect_id]['sasl_realm'];
$authz_id = null;
if (DEBUG_ENABLED)
debug_log('Resource [%s], Using SASL bind method. Bind DN [%s]',9,__FILE__,__LINE__,__METHOD__,
$resource,$this->connection[$connect_id]['login_dn']);
# do we need to rewrite authz_id?
if (isset($this->connection[$connect_id]['sasl_authz_id']) &&
strlen($this->connection[$connect_id]['sasl_authz_id']) > 0)
$authz_id = $this->connection[$connect_id]['sasl_authz_id'];
else {
# ok, here we go
if (DEBUG_ENABLED)
debug_log('Resource [%s], Rewriting bind DN [%s] -> authz_id with regex [%s] and replacement [%s].',9,__FILE__,__LINE__,__METHOD__,
$resource,$this->connection[$connect_id]['login_dn'],
$this->connection[$connect_id]['sasl_authz_id_regex'],
$this->connection[$connect_id]['sasl_authz_id_replacement']);
$authz_id = @preg_replace($this->connection[$connect_id]['sasl_authz_id_regex'],
$this->connection[$connect_id]['sasl_authz_id_replacement'],
$this->connection[$connect_id]['login_dn']);
# invalid regex?
if (is_null($authz_id)) {
pla_error(sprintf(_('It seems that sasl_authz_id_regex "%s"." contains invalid PCRE regular expression.'),
$this->connection[$connect_id]['sasl_authz_id_regex']).
((isset($php_errormsg)) ? ' Error message: '.$php_errormsg : ''));
}
}
if (DEBUG_ENABLED)
debug_log('Resource [%s], SASL OPTIONS: mech [%s], realm [%s], authz_id [%s], props [%s]',9,__FILE__,__LINE__,__METHOD__,
$resource,$mech,$realm,$authz_id,$props);
$bind_result = @ldap_sasl_bind($resource,
$this->connection[$connect_id]['login_dn'],$this->connection[$connect_id]['login_pass'],
$mech,$realm,$authz_id,$props);
} else {
$bind_result = @ldap_bind($resource,$this->connection[$connect_id]['login_dn'],
$this->connection[$connect_id]['login_pass']);
}
if (DEBUG_ENABLED)
debug_log('Resource [%s], Bind Result [%s]',16,__FILE__,__LINE__,__METHOD__,$resource,$bind_result);
if (! $bind_result) {
if (DEBUG_ENABLED)
debug_log('Leaving with FALSE, bind FAILed',16,__FILE__,__LINE__,__METHOD__);
if ($process_error) {
switch (ldap_errno($resource)) {
case 0x31:
error(_('Bad username or password. Please try again.'),'error');
break;
case 0x32:
error(_('Insufficient access rights.'),'error');
break;
case -1:
error(sprintf(_('Could not connect to "%s" on port "%s"'),$host,$port),'error');
break;
default:
error(_('Could not bind to the LDAP server (%s).',ldap_err2str($resource),$resource),'error');
}
} else {
return false;
}
}
if (is_resource($resource) && ($bind_result)) {
if (DEBUG_ENABLED)
debug_log('Bind successful',16,__FILE__,__LINE__,__METHOD__);
$this->connection[$connect_id]['resource'] = $resource;
}
if (DEBUG_ENABLED)
debug_log('Leaving with Connect [%s], Resource [%s]',16,__FILE__,__LINE__,__METHOD__,
$connect_id,$this->connection[$connect_id]['resource']);
return $this->connection[$connect_id]['resource'];
}
/**
* Gets the root DN of the specified LDAPServer, or null if it
* can't find it (ie, the server won't give it to us, or it isnt
* specified in the configuration file).
*
* Tested with OpenLDAP 2.0, Netscape iPlanet, and Novell eDirectory 8.7 (nldap.com)
* Please report any and all bugs!!
*
* Please note: On FC systems, it seems that php_ldap uses /etc/openldap/ldap.conf in
* the search base if it is blank - so edit that file and comment out the BASE line.
*
* @return array dn|null The root DN of the server on success (string) or null on error.
* @todo Sort the entries, so that they are in the correct DN order.
*/
function getBaseDN() {
if (DEBUG_ENABLED)
debug_log('Entered with ()',17,__FILE__,__LINE__,__METHOD__);
# Return the cached entry if we've been here before.
if (! is_null($this->_baseDN)) {
debug_log('Return CACHED BaseDN [%s]',17,__FILE__,__LINE__,__METHOD__,implode('|',$this->_baseDN));
return $this->_baseDN;
}
if (DEBUG_ENABLED)
debug_log('Checking config for BaseDN',80,__FILE__,__LINE__,__METHOD__);
# If the base is set in the configuration file, then just return that.
if (count($_SESSION[APPCONFIG]->ldapservers->GetValue($this->server_id,'server','base')) > 0) {
$this->_baseDN = $_SESSION[APPCONFIG]->ldapservers->GetValue($this->server_id,'server','base');
if (DEBUG_ENABLED)
debug_log('Return BaseDN from Config [%s]',17,__FILE__,__LINE__,__METHOD__,implode('|',$this->_baseDN));
return $this->_baseDN;
# We need to figure it out.
} else {
if (DEBUG_ENABLED)
debug_log('Connect to LDAP to find BaseDN',80,__FILE__,__LINE__,__METHOD__);
if ($this->connect()) {
$r = $this->search(null,'','objectClass=*',array('namingContexts'),'base');
$r = array_pop($r);
if (is_array($r))
$r = array_change_key_case($r);
if (isset($r['namingcontexts'])) {
if (! is_array($r['namingcontexts']))
$r['namingcontexts'] = array($r['namingcontexts']);
if (DEBUG_ENABLED)
debug_log('LDAP Entries:%s',80,__FILE__,__LINE__,__METHOD__,implode('|',$r['namingcontexts']));
$this->_baseDN = $r['namingcontexts'];
return $this->_baseDN;
} else {
return array('');
}
} else {
return array('');
}
}
}
/**
* Returns true if the specified server is configured to be displayed
* in read only mode.
*
* If a user has logged in via anonymous bind, and config.php specifies
* <code>
* $config->custom->appearance['anonymous_bind_implies_read_only'] = true;
* </code>
* then this also returns true. Servers can be configured read-only in
* config.php thus:
* <code>
* $ldapservers->SetValue($i,'server','read_only',false);
* </code>
*
* @return bool
*/
function isReadOnly() {
# Set default return
$return = false;
if ($this->read_only == true)
$return = true;
elseif ($this->getLoggedInDN() === 'anonymous' &&
($_SESSION[APPCONFIG]->GetValue('appearance','anonymous_bind_implies_read_only') === true))
$return = true;
if (DEBUG_ENABLED)
debug_log('Entered with (), Returning (%s)',17,__FILE__,__LINE__,__METHOD__,$return);
return $return;
}
/**
* Returns true if the user has configured the specified server to enable mass deletion.
*
* Mass deletion is enabled in config.php this:
* <code>
* $config->custom->commands['all'] = array('entry_delete' => array('mass_delete' => true));
* </code>
* Notice that mass deletes are not enabled on a per-server basis, but this
* function checks that the server is not in a read-only state as well.
*
* @return bool
*/
function isMassDeleteEnabled() {
if (DEBUG_ENABLED)
debug_log('Entered with ()',17,__FILE__,__LINE__,__METHOD__);
if ($this->connect(false) && $this->haveAuthInfo() && ! $this->isReadOnly() &&
$_SESSION[APPCONFIG]->isCommandAvailable('entry_delete', 'mass_delete'))
return true;
else
return false;
}
/**
* Gets whether the admin has configured phpLDAPadmin to show the "Create New" link in the tree viewer.
* <code>
* $ldapservers->SetValue($i,'appearance','show_create','true|false');
* </code>
* If NOT set, then default to show the Create New item.
* If IS set, then return the value (it should be true or false).
*
* The entry creation command must be available.
* <code>
* $config->custom->commands['all'] = array('entry_create' => true);
* </code>
*
* @default true
* @return bool True if the feature is enabled and false otherwise.
*/
function isShowCreateEnabled() {
if (DEBUG_ENABLED)
debug_log('Entered with ()',17,__FILE__,__LINE__,__METHOD__);
if (! $_SESSION[APPCONFIG]->isCommandAvailable('entry_create')) return false;
else return $this->show_create;
}
/**
* Fetch whether the user has configured a certain server as "low bandwidth".
*
* Users may choose to configure a server as "low bandwidth" in config.php thus:
* <code>
* $ldapservers->SetValue($i,'server','low_bandwidth','true|false');
* </code>
*
* @default false
* @return bool
*/
function isLowBandwidth() {
if (DEBUG_ENABLED)
debug_log('Entered with ()',17,__FILE__,__LINE__,__METHOD__);
return $this->low_bandwidth;
}
/**
* Should this LDAP server be shown in the tree?
*
* <code>
* $ldapservers->SetValue($i,'server','visible','true|false');
* </code>
*
* @default true
* @return bool True if the feature is enabled and false otherwise.
*/
function isVisible() {
if ($this->visible)
$return = true;
else
$return = false;
if (DEBUG_ENABLED)
debug_log('Entered with (), Returning (%s)',17,__FILE__,__LINE__,__METHOD__,$return);
return $return;
}
/**
* This function will query the ldap server and request the subSchemaSubEntry which should be the Schema DN.
*
* If we cant connect to the LDAP server, we'll return false.
* If we can connect but cant get the entry, then we'll return null.
*
* @return array|false Schema if available, null if its not or false if we cant connect.
*/
function getSchemaDN($dn='') {
if (DEBUG_ENABLED)
debug_log('Entered with (%s)',25,__FILE__,__LINE__,__METHOD__,$dn);
# If we already got the SchemaDN, then return it.
if ($this->_schemaDN)
return $this->_schemaDN;
if (! $this->connect())
return false;
$this->lastop = 'read';
$search = @ldap_read($this->connect(),$dn,'objectClass=*',array('subschemaSubentry'));
if (DEBUG_ENABLED)
debug_log('Search returned (%s)',24,__FILE__,__LINE__,__METHOD__,is_resource($search));
# Fix for broken ldap.conf configuration.
if (! $search && ! $dn) {
if (DEBUG_ENABLED)
debug_log('Trying to find the DN for "broken" ldap.conf',80,__FILE__,__LINE__,__METHOD__);
if (isset($this->_baseDN)) {
foreach ($this->_baseDN as $base) {
$search = @ldap_read($this->connect(),$base,'objectClass=*',array('subschemaSubentry'));
if (DEBUG_ENABLED)
debug_log('Search returned (%s) for base (%s)',24,__FILE__,__LINE__,__METHOD__,
is_resource($search),$base);
if ($search)
break;
}
}
}
if (! $search)
return null;
if (! @ldap_count_entries($this->connect(),$search)) {
if (DEBUG_ENABLED)
debug_log('Search returned 0 entries. Returning NULL',25,__FILE__,__LINE__,__METHOD__);
return null;
}
$entries = @ldap_get_entries($this->connect(),$search);
if (DEBUG_ENABLED)
debug_log('Search returned [%s]',24,__FILE__,__LINE__,__METHOD__,$entries);
if (! $entries || ! is_array($entries))
return null;
$entry = isset($entries[0]) ? $entries[0] : false;
if (! $entry) {
if (DEBUG_ENABLED)
debug_log('Entry is false, Returning NULL',80,__FILE__,__LINE__,__METHOD__);
return null;
}
$sub_schema_sub_entry = isset($entry[0]) ? $entry[0] : false;
if (! $sub_schema_sub_entry) {
if (DEBUG_ENABLED)
debug_log('Sub Entry is false, Returning NULL',80,__FILE__,__LINE__,__METHOD__);
return null;
}
$this->_schemaDN = isset($entry[$sub_schema_sub_entry][0]) ? $entry[$sub_schema_sub_entry][0] : false;
if (DEBUG_ENABLED)
debug_log('Returning (%s)',25,__FILE__,__LINE__,__METHOD__,$this->_schemaDN);
return $this->_schemaDN;
}
/**
* Fetches the raw schema array for the subschemaSubentry of the server. Note,
* this function has grown many hairs to accomodate more LDAP servers. It is
* needfully complicated as it now supports many popular LDAP servers that
* don't necessarily expose their schema "the right way".
*
* Please note: On FC systems, it seems that php_ldap uses /etc/openldap/ldap.conf in
* the search base if it is blank - so edit that file and comment out the BASE line.
*
* @param string $schema_to_fetch - A string indicating which type of schema to
* fetch. Five valid values: 'objectclasses', 'attributetypes',
* 'ldapsyntaxes', 'matchingruleuse', or 'matchingrules'.
* Case insensitive.
* @param dn $dn (optional) This paremeter is the DN of the entry whose schema you
* would like to fetch. Entries have the option of specifying
* their own subschemaSubentry that points to the DN of the system
* schema entry which applies to this attribute. If unspecified,
* this will try to retrieve the schema from the RootDSE subschemaSubentry.
* Failing that, we use some commonly known schema DNs. Default
* value is the Root DSE DN (zero-length string)
* @return array an array of strings of this form:
* Array (
* [0] => "(1.3.6.1.4.1.7165.1.2.2.4 NAME 'gidPool' DESC 'Pool ...
* [1] => "(1.3.6.1.4.1.7165.2.2.3 NAME 'sambaAccount' DESC 'Sa ...
* etc.
*/
function getRawSchema($schema_to_fetch,$dn='') {
if (DEBUG_ENABLED)
debug_log('Entered with (%s,%s)',25,__FILE__,__LINE__,__METHOD__,$schema_to_fetch,$dn);
$valid_schema_to_fetch = array('objectclasses','attributetypes','ldapsyntaxes','matchingrules','matchingruleuse');
if (! $this->connect())
return false;
# error checking
$schema_to_fetch = strtolower($schema_to_fetch);
if (!is_null($this->_schema_entries) && isset($this->_schema_entries[$schema_to_fetch])) {
$schema = $this->_schema_entries[$schema_to_fetch];
if (DEBUG_ENABLED)
debug_log('Returning CACHED (%s)',25,__FILE__,__LINE__,__METHOD__,$schema);
return $schema;
}
# This error message is not localized as only developers should ever see it
if (! in_array($schema_to_fetch,$valid_schema_to_fetch))
pla_error(sprintf('Bad parameter provided to function to %s::getRawSchema(). "%s" is not valid for the schema_to_fetch parameter.',
get_class($this),htmlspecialchars($schema_to_fetch)));
# Try to get the schema DN from the specified entry.
$schema_dn = $this->getSchemaDN($dn);
# Do we need to try again with the Root DSE?
if (! $schema_dn)
$schema_dn = $this->getSchemaDN('');
# Store the eventual schema retrieval in $schema_search
$schema_search = null;
if ($schema_dn) {
if (DEBUG_ENABLED)
debug_log('Using Schema DN (%s)',24,__FILE__,__LINE__,__METHOD__,$schema_dn);
foreach (array('(objectClass=*)','(objectClass=subschema)') as $schema_filter) {
if (DEBUG_ENABLED)
debug_log('Looking for schema with Filter (%s)',24,__FILE__,__LINE__,__METHOD__,$schema_filter);
$schema_search = @ldap_read($this->connect(),$schema_dn,$schema_filter,array($schema_to_fetch),0,0,0,LDAP_DEREF_ALWAYS);
if (is_null($schema_search))
continue;
$schema_entries = @ldap_get_entries($this->connect(),$schema_search);
if (DEBUG_ENABLED)
debug_log('Search returned [%s]',24,__FILE__,__LINE__,__METHOD__,$schema_entries);
if (is_array($schema_entries) && isset($schema_entries['count']) && $schema_entries['count']) {
if (DEBUG_ENABLED)
debug_log('Found schema with (DN:%s) (FILTER:%s) (ATTR:%s)',24,__FILE__,__LINE__,__METHOD__,
$schema_dn,$schema_filter,$schema_to_fetch);
break;
}
if (DEBUG_ENABLED)
debug_log('Didnt find schema with filter (%s)',24,__FILE__,__LINE__,__METHOD__,$schema_filter);
unset($schema_entries);
$schema_search = null;
}
}
/* Second chance: If the DN or Root DSE didn't give us the subschemaSubentry, ie $schema_search
* is still null, use some common subSchemaSubentry DNs as a work-around. */
if (is_null($schema_search)) {
if (DEBUG_ENABLED)
debug_log('Attempting work-arounds for "broken" LDAP servers...',24,__FILE__,__LINE__,__METHOD__);
foreach ($this->getBaseDN() as $base) {
$ldap['W2K3 AD'][expand_dn_with_base($base,'cn=Aggregate,cn=Schema,cn=configuration,')] = '(objectClass=*)';
$ldap['W2K AD'][expand_dn_with_base($base,'cn=Schema,cn=configuration,')] = '(objectClass=*)';
$ldap['W2K AD'][expand_dn_with_base($base,'cn=Schema,ou=Admin,')] = '(objectClass=*)';
}
# OpenLDAP and Novell
$ldap['OpenLDAP']['cn=subschema'] = '(objectClass=*)';
foreach ($ldap as $ldap_server_name => $ldap_options) {
foreach ($ldap_options as $ldap_dn => $ldap_filter) {
if (DEBUG_ENABLED)
debug_log('Attempting [%s] (%s) (%s)<BR>',24,__FILE__,__LINE__,__METHOD__,
$ldap_server_name,$ldap_dn,$ldap_filter);
$schema_search = @ldap_read($this->connect(),$ldap_dn,$ldap_filter,
array($schema_to_fetch), 0, 0, 0, LDAP_DEREF_ALWAYS);
if (is_null($schema_search))
continue;
$schema_entries = @ldap_get_entries($this->connect(),$schema_search);
if (DEBUG_ENABLED)
debug_log('Search returned [%s]',24,__FILE__,__LINE__,__METHOD__,$schema_entries);
if ($schema_entries && isset($schema_entries[0][$schema_to_fetch])) {
if (DEBUG_ENABLED)
debug_log('Found schema with filter of (%s)',24,__FILE__,__LINE__,__METHOD__,$ldap_filter);
break;
}
if (DEBUG_ENABLED)
debug_log('Didnt find schema with filter (%s)',24,__FILE__,__LINE__,__METHOD__,$ldap_filter);
unset($schema_entries);
$schema_search = null;
}
if ($schema_search)
break;
}
}
if (is_null($schema_search)) {
/* Still cant find the schema, try with the RootDSE
* Attempt to pull schema from Root DSE with scope "base", or
* Attempt to pull schema from Root DSE with scope "one" (work-around for Isode M-Vault X.500/LDAP) */
foreach (array('base','one') as $ldap_scope) {
if (DEBUG_ENABLED)
debug_log('Attempting to find schema with scope (%s), filter (objectClass=*) and a blank base.',24,__FILE__,__LINE__,__METHOD__,
$ldap_scope);
switch ($ldap_scope) {
case 'base':
$schema_search = @ldap_read($this->connect(),'','(objectClass=*)',array($schema_to_fetch),0,0,0,LDAP_DEREF_ALWAYS);
break;
case 'one':
$schema_search = @ldap_list($this->connect(),'','(objectClass=*)',array($schema_to_fetch),0,0,0,LDAP_DEREF_ALWAYS);
break;
}
if (is_null($schema_search))
continue;
$schema_entries = @ldap_get_entries($this->connect(),$schema_search);
if (DEBUG_ENABLED)
debug_log('Search returned [%s]',24,__FILE__,__LINE__,__METHOD__,$schema_entries);
if ($schema_entries && isset($schema_entries[0][$schema_to_fetch])) {
if (DEBUG_ENABLED)
debug_log('Found schema with filter of (%s)',24,__FILE__,__LINE__,__METHOD__,'(objectClass=*)');
break;
}
if (DEBUG_ENABLED)
debug_log('Didnt find schema with filter (%s)',24,__FILE__,__LINE__,__METHOD__,'(objectClass=*)');
unset($schema_entries);
$schema_search = null;
}
}
$schema_error_message = 'Please contact the phpLDAPadmin developers and let them know:<ul><li>Which LDAP server you are running, including which version<li>What OS it is running on<li>Which version of PHP<li>As well as a link to some documentation that describes how to obtain the SCHEMA information</ul><br />We\'ll then add support for your LDAP server in an upcoming release.';
$schema_error_message_array = array('objectclasses','attributetypes');
# Shall we just give up?
if (is_null($schema_search)) {
# We need to have objectclasses and attribues, so display an error, asking the user to get us this information.
if (in_array($schema_to_fetch,$schema_error_message_array)) {
pla_error(sprintf('Our attempts to find your SCHEMA for "%s" have FAILED.<br /><br />%s',$schema_to_fetch,$schema_error_message));
} else {
$return = false;
if (DEBUG_ENABLED)
debug_log('Returning because schema_search is NULL (%s)',25,__FILE__,__LINE__,__METHOD__,$return);
return $return;
}
}
# Did we get something unrecognizable?
if (gettype($schema_search) != 'resource') {
if (in_array($schema_to_fetch,$schema_error_message_array)) {
pla_error(sprintf('Our attempts to find your SCHEMA for "%s" has return UNEXPECTED results.<br /><br /><small>(We expected a "resource" for $schema_search, instead, we got (%s))</small><br /><br />%s<br /><br />Dump of $schema_search:<hr /><pre><small>%s</small></pre>',
$schema_to_fetch,gettype($schema_search),$schema_error_message,serialize($schema_search)));
} else {
$return = false;
if (DEBUG_ENABLED)
debug_log('Returning because schema_search type is not a resource (%s)',25,__FILE__,__LINE__,__METHOD__,$return);
return $return;
}
}
if (! $schema_entries) {
$return = false;
if (DEBUG_ENABLED)
debug_log('Returning false since ldap_get_entries() returned false.',25,__FILE__,__LINE__,__METHOD__,$return);
return $return;
}
if(! isset($schema_entries[0][$schema_to_fetch])) {
if (in_array($schema_to_fetch,$schema_error_message_array)) {
pla_error(sprintf('Our attempts to find your SCHEMA for "%s" has return UNEXPECTED results.<br /><br /><small>(We expected a "%s" in the $schema array but it wasnt there.)</small><br /><br />%s<br /><br />Dump of $schema_search:<hr /><pre><small>%s</small></pre>',
$schema_to_fetch,gettype($schema_search),$schema_error_message,serialize($schema_entries)));
} else {
$return = false;
if (DEBUG_ENABLED)
debug_log('Returning because (%s) isnt in the schema array. (%s)',25,__FILE__,__LINE__,__METHOD__,$schema_to_fetch,$return);
return $return;
}
}
/* Make a nice array of this form:
Array (
[0] => "(1.3.6.1.4.1.7165.1.2.2.4 NAME 'gidPool' DESC 'Pool ...)"
[1] => "(1.3.6.1.4.1.7165.2.2.3 NAME 'sambaAccount' DESC 'Sa ...)"
etc.) */
$schema = $schema_entries[0][$schema_to_fetch];
unset($schema['count']);
$this->_schema_entries[$schema_to_fetch] = $schema;
if (DEBUG_ENABLED)
debug_log('Returning (%s)',25,__FILE__,__LINE__,__METHOD__,$schema);
return $schema;
}
/**
* Return the attribute used for login
*/
function getLoginAttr() {
return $this->login_attr;
}
/**
* Fetches whether the login_attr feature is enabled for a specified server.
*
* This is configured in config.php thus:
* <code>
* $ldapservers->SetValue($i,'login','attr','<ldap attr>');
* </code>
*
* By virtue of the fact that the login_attr is not blank and not 'dn', the
* feature is configured to be enabled.
*
* @default uid
* @return bool
*/
function isLoginAttrEnabled() {
if ((strcasecmp($this->getLoginAttr(),'dn') != 0) && trim($this->getLoginAttr()))
$return = true;
else
$return = false;
if (DEBUG_ENABLED)
debug_log('Entered with (), Returning (%s)',17,__FILE__,__LINE__,__METHOD__,$return);
return $return;
}
/**
* Fetches whether the login_attr feature is enabled for a specified server.
*
* This is configured in config.php thus:
* <code>
* $ldapservers->SetValue($i,'login','attr','string');
* </code>
*
* @return bool
*/
function isLoginStringEnabled() {
if (DEBUG_ENABLED)
debug_log('login_attr is [%s]',80,__FILE__,__LINE__,__METHOD__,$this->getLoginAttr());
if (! strcasecmp($this->getLoginAttr(),'string'))
$return = true;
else
$return = false;
if (DEBUG_ENABLED)
debug_log('Entered with (), Returning (%s)',17,__FILE__,__LINE__,__METHOD__,$return);
return $return;
}
/**
* Fetches the login_attr string if enabled for a specified server.
*
* This is configured in config.php thus:
* <code>
* $ldapservers->SetValue($i,'login','login_string','uid=<username>,ou=People,dc=example,dc=com');
* </code>
*
* @return string|false
*/
function getLoginString() {
if (DEBUG_ENABLED)
debug_log('Entered with ()',17,__FILE__,__LINE__,__METHOD__,__FILE__,__LINE__,__METHOD__);
return $this->login_string;
}
/**
* Fetch whether the user has configured a certain server login to be non anonymous
*
* <code>
* $ldapservers->SetValue($i,'login','anon_bind','true|false');
* </code>
*
* @default true
* @return bool
*/
function isAnonBindAllowed() {
# If only_login_allowed_dns is set, then we cant have anonymous.
if (count($_SESSION[APPCONFIG]->ldapservers->GetValue($this->server_id,'login','allowed_dns')) > 0)
$return = false;
else
$return = $_SESSION[APPCONFIG]->ldapservers->GetValue($this->server_id,'login','anon_bind');
if (DEBUG_ENABLED)
debug_log('Entered with (), Returning (%s)',17,__FILE__,__LINE__,__METHOD__,$return);
return $return;
}
/**
* Fetches whether TLS has been configured for use with a certain server.
*
* Users may configure phpLDAPadmin to use TLS in config,php thus:
* <code>
* $ldapservers->SetValue($i,'login','tls','true|false');
* </code>
*
* @default false
* @return bool
*/
function isTLSEnabled() {
if (DEBUG_ENABLED)
debug_log('Entered with ()',17,__FILE__,__LINE__,__METHOD__);
return $this->tls;
}
/**
* Returns true if the user has configured the specified server to enable branch (non-leaf) renames.
*
* This is configured in config.php thus:
* <code>
* $ldapservers->SetValue($i,'server','branch_rename','true|false');
* </code>
*
* @default false
* @param int $server_id The ID of the server of interest from config.php.
* @return bool
*/
function isBranchRenameEnabled() {
debug_log('Entered with (), Returning (%s).',17,__FILE__,__LINE__,__METHOD__,$this->branch_rename);
return $this->branch_rename;
}
/**
* Gets an associative array of ObjectClass objects for the specified
* server. Each array entry's key is the name of the objectClass
* in lower-case and the value is an ObjectClass object.
*
* @param string $dn (optional) It is easier to fetch schema if a DN is provided
* which defines the subschemaSubEntry attribute (all entries should).
*
* @return array An array of ObjectClass objects.
*
* @see ObjectClass
* @see getSchemaObjectClass
*/
function SchemaObjectClasses($dn='') {
debug_log('Entered with (%s)',25,__FILE__,__LINE__,__METHOD__,$dn);
# Set default return
$return = null;
if ($return = get_cached_item($this->server_id,'schema','objectclasses')) {
debug_log('Returning CACHED [%s] (%s)',25,__FILE__,__LINE__,__METHOD__,$this->server_id,'objectclasses');
return $return;
}
$raw_oclasses = $this->getRawSchema('objectclasses',$dn);
if ($raw_oclasses) {
# build the array of objectClasses
$return = array();
foreach ($raw_oclasses as $class_string) {
if (is_null($class_string) || ! strlen($class_string))
continue;
$object_class = new ObjectClass($class_string,$this);
$return[strtolower($object_class->getName())] = $object_class;
}
# Now go through and reference the parent/child relationships
foreach ($return as $oclass) {
foreach ($oclass->getSupClasses() as $parent_name) {
if (isset($return[strtolower($parent_name)]))
$return[strtolower($parent_name)]->addChildObjectClass($oclass->getName());
}
}
ksort($return);
# cache the schema to prevent multiple schema fetches from LDAP server
set_cached_item($this->server_id,'schema','objectclasses',$return);
}
debug_log('Returning (%s)',25,__FILE__,__LINE__,__METHOD__,$return);
return $return;
}
/**
* Gets a single ObjectClass object specified by name.
*
* @param string $oclass_name The name of the objectClass to fetch.
* @param string $dn (optional) It is easier to fetch schema if a DN is provided
* which defines the subschemaSubEntry attribute (all entries should).
*
* @return ObjectClass The specified ObjectClass object or false on error.
*
* @see ObjectClass
* @see SchemaObjectClasses
*/
function getSchemaObjectClass($oclass_name,$dn='') {
$oclass_name = strtolower($oclass_name);
$oclasses = $this->SchemaObjectClasses($dn);
# Default return value
$return = false;
if (isset($oclasses[$oclass_name]))
$return = $oclasses[$oclass_name];
debug_log('Entered with (%s,%s), Returning (%s).',25,__FILE__,__LINE__,__METHOD__,$oclass_name,$dn,$return);
return $return;
}
/**
* Gets a single AttributeType object specified by name.
*
* @param string $oclass_name The name of the AttributeType to fetch.
* @param string $dn (optional) It is easier to fetch schema if a DN is provided
* which defines the subschemaSubEntry attribute (all entries should).
*
* @return AttributeType The specified AttributeType object or false on error.
*
* @see AttributeType
* @see SchemaAttributes
*/
function getSchemaAttribute($attr_name,$dn=null) {
$attr_name = real_attr_name(strtolower($attr_name));
$schema_attrs = $this->SchemaAttributes($dn);
# Default return value
$return = false;
if (isset($schema_attrs[$attr_name]))
$return = $schema_attrs[$attr_name];
debug_log('Entered with (%s,%s), Returning (%s).',25,__FILE__,__LINE__,__METHOD__,$attr_name,$dn,$return);
return $return;
}
/**
* Gets an associative array of AttributeType objects for the specified
* server. Each array entry's key is the name of the attributeType
* in lower-case and the value is an AttributeType object.
*
* @param int $server_id The ID of the server whose AttributeTypes to fetch
* @param string $dn (optional) It is easier to fetch schema if a DN is provided
* which defines the subschemaSubEntry attribute (all entries should).
*
* @return array An array of AttributeType objects.
*/
function SchemaAttributes($dn=null) {
debug_log('Entered with (%s)',25,__FILE__,__LINE__,__METHOD__,$dn);
# Set default return
$return = null;
if ($return = get_cached_item($this->server_id,'schema','attributes')) {
debug_log('(): Returning CACHED [%s] (%s)',25,__FILE__,__LINE__,__METHOD__,$this->server_id,'attributes');
return $return;
}
$raw_attrs = $this->getRawSchema('attributeTypes',$dn);
if ($raw_attrs) {
# build the array of attribueTypes
$syntaxes = $this->SchemaSyntaxes($dn);
$attrs = array();
/**
* bug 856832: create two arrays - one indexed by name (the standard
* $attrs array above) and one indexed by oid (the new $attrs_oid array
* below). This will help for directory servers, like IBM's, that use OIDs
* in their attribute definitions of SUP, etc
*/
$attrs_oid = array();
foreach ($raw_attrs as $attr_string) {
if (is_null($attr_string) || ! strlen($attr_string))
continue;
$attr = new AttributeType($attr_string);
if (isset($syntaxes[$attr->getSyntaxOID()])) {
$syntax = $syntaxes[$attr->getSyntaxOID()];
$attr->setType($syntax->getDescription());
}
$attrs[strtolower($attr->getName())] = $attr;
/**
* bug 856832: create an entry in the $attrs_oid array too. This
* will be a ref to the $attrs entry for maintenance and performance
* reasons
*/
$attrs_oid[$attr->getOID()] = &$attrs[strtolower($attr->getName())];
}
# go back and add data from aliased attributeTypes
foreach ($attrs as $name => $attr) {
$aliases = $attr->getAliases();
if (is_array($aliases) && count($aliases) > 0) {
/* foreach of the attribute's aliases, create a new entry in the attrs array
* with its name set to the alias name, and all other data copied.*/
foreach ($aliases as $alias_attr_name) {
$new_attr = clone $attr;
$new_attr->setName($alias_attr_name);
$new_attr->addAlias($attr->getName());
$new_attr->removeAlias($alias_attr_name);
$new_attr_key = strtolower($alias_attr_name);
$attrs[$new_attr_key] = $new_attr;
}
}
}
# go back and add any inherited descriptions from parent attributes (ie, cn inherits name)
foreach ($attrs as $key => $attr) {
$sup_attr_name = $attr->getSupAttribute();
$sup_attr = null;
if (trim($sup_attr_name)) {
/* This loop really should traverse infinite levels of inheritance (SUP) for attributeTypes,
* but just in case we get carried away, stop at 100. This shouldn't happen, but for
* some weird reason, we have had someone report that it has happened. Oh well.*/
$i = 0;
while ($i++<100 /** 100 == INFINITY ;) */) {
if (isset($attrs_oid[$sup_attr_name])) {
$attr->setSupAttribute($attrs_oid[$sup_attr_name]->getName());
$sup_attr_name = $attr->getSupAttribute();
}
if (! isset($attrs[strtolower($sup_attr_name)])){
pla_error(sprintf('Schema error: attributeType "%s" inherits from "%s", but attributeType "%s" does not exist.',
$attr->getName(),$sup_attr_name,$sup_attr_name));
return;
}
$sup_attr = $attrs[strtolower($sup_attr_name)];
$sup_attr_name = $sup_attr->getSupAttribute();
# Does this superior attributeType not have a superior attributeType?
if (is_null($sup_attr_name) || strlen(trim($sup_attr_name)) == 0) {
/* Since this attribute's superior attribute does not have another superior
* attribute, clone its properties for this attribute. Then, replace
* those cloned values with those that can be explicitly set by the child
* attribute attr). Save those few properties which the child can set here:*/
$tmp_name = $attr->getName();
$tmp_oid = $attr->getOID();
$tmp_sup = $attr->getSupAttribute();
$tmp_aliases = $attr->getAliases();
$tmp_single_val = $attr->getIsSingleValue();
$tmp_desc = $attr->getDescription();
/* clone the SUP attributeType and populate those values
* that were set by the child attributeType */
$attr = clone $sup_attr;
$attr->setOID($tmp_oid);
$attr->setName($tmp_name);
$attr->setSupAttribute($tmp_sup);
$attr->setAliases($tmp_aliases);
$attr->setDescription($tmp_desc);
/* only overwrite the SINGLE-VALUE property if the child explicitly sets it
* (note: All LDAP attributes default to multi-value if not explicitly set SINGLE-VALUE) */
if ($tmp_single_val)
$attr->setIsSingleValue(true);
/* replace this attribute in the attrs array now that we have populated
new values therein */
$attrs[$key] = $attr;
# very important: break out after we are done with this attribute
$sup_attr_name = null;
$sup_attr = null;
break;
}
}
}
}
ksort($attrs);
# Add the used in and required_by values.
$schema_object_classes = $this->SchemaObjectClasses();
if (! is_array($schema_object_classes))
return array();
foreach ($schema_object_classes as $object_class) {
$must_attrs = $object_class->getMustAttrNames($schema_object_classes);
$may_attrs = $object_class->getMayAttrNames($schema_object_classes);
$oclass_attrs = array_unique(array_merge($must_attrs,$may_attrs));
# Add Used In.
foreach ($oclass_attrs as $attr_name) {
if (isset($attrs[strtolower($attr_name)]))
$attrs[strtolower($attr_name)]->addUsedInObjectClass($object_class->getName());
else {
#echo "Warning, attr not set: $attr_name<br />";
}
}
# Add Required By.
foreach ($must_attrs as $attr_name) {
if (isset($attrs[strtolower($attr_name)]))
$attrs[strtolower($attr_name)]->addRequiredByObjectClass($object_class->getName());
else {
#echo "Warning, attr not set: $attr_name<br />";
}
}
}
$return = $attrs;
# cache the schema to prevent multiple schema fetches from LDAP server
set_cached_item($this->server_id,'schema','attributes',$return);
}
debug_log('Returning (%s)',25,__FILE__,__LINE__,__METHOD__,$return);
return $return;
}
/**
* Returns an array of MatchingRule objects for the specified server.
* The key of each entry is the OID of the matching rule.
*/
function MatchingRules($dn=null) {
# Set default return
$return = null;
if ($return = get_cached_item($this->server_id,'schema','matchingrules')) {
debug_log('Returning CACHED [%s] (%s).',25,__FILE__,__LINE__,__METHOD__,$this->server_id,'matchingrules');
return $return;
}
# build the array of MatchingRule objects
$raw_matching_rules = $this->getRawSchema('matchingRules',$dn);
if ($raw_matching_rules) {
$rules = array();
foreach ($raw_matching_rules as $rule_string) {
if (is_null($rule_string) || 0 == strlen($rule_string))
continue;
$rule = new MatchingRule($rule_string);
$key = strtolower($rule->getName());
$rules[$key] = $rule;
}
ksort($rules);
/* For each MatchingRuleUse entry, add the attributes who use it to the
* MatchingRule in the $rules array.*/
$raw_matching_rule_use = $this->getRawSchema('matchingRuleUse');
if ($raw_matching_rule_use != false) {
foreach ($raw_matching_rule_use as $rule_use_string) {
if ($rule_use_string == null || 0 == strlen($rule_use_string))
continue;
$rule_use = new MatchingRuleUse($rule_use_string);
$key = strtolower($rule_use->getName());
if (isset($rules[$key]))
$rules[$key]->setUsedByAttrs($rule_use->getUsedByAttrs());
}
} else {
/* No MatchingRuleUse entry in the subschema, so brute-forcing
* the reverse-map for the "$rule->getUsedByAttrs()" data.*/
$attrs = $this->SchemaAttributes($dn);
if (is_array($attrs))
foreach ($attrs as $attr) {
$rule_key = strtolower($attr->getEquality());
if (isset($rules[$rule_key]))
$rules[$rule_key]->addUsedByAttr($attr->getName());
}
}
$return = $rules;
# cache the schema to prevent multiple schema fetches from LDAP server
set_cached_item($this->server_id,'schema','matchingrules',$return);
}
debug_log('Entered with (%s), Returning (%s).',25,__FILE__,__LINE__,__METHOD__,$dn,$return);
return $return;
}
/**
* Returns an array of Syntax objects that this LDAP server uses mapped to
* their descriptions. The key of each entry is the OID of the Syntax.
*/
function SchemaSyntaxes($dn=null) {
# Set default return
$return = null;
if ($return = get_cached_item($this->server_id,'schema','syntaxes')) {
debug_log('Returning CACHED [%s] (%s).',25,__FILE__,__LINE__,__METHOD__,$this->server_id,'syntaxes');
return $return;
}
$raw_syntaxes = $this->getRawSchema('ldapSyntaxes',$dn);
if ($raw_syntaxes) {
# build the array of attributes
$return = array();
foreach ($raw_syntaxes as $syntax_string) {
$syntax = new Syntax($syntax_string);
$key = strtolower(trim($syntax->getOID()));
if (! $key)
continue;
$return[$key] = $syntax;
}
ksort($return);
# cache the schema to prevent multiple schema fetches from LDAP server
set_cached_item($this->server_id,'schema','syntaxes',$return);
}
debug_log('Entered with (%s), Returning (%s).',25,__FILE__,__LINE__,__METHOD__,$dn,$return);
return $return;
}
/**
* Add objects
*
*/
function add($dn,$entry_array) {
$this->lastop = 'write';
foreach ($entry_array as $attr => $val) {
$entry_array[$attr] = dn_unescape($val);
}
$result = @ldap_add($this->connect(true,$this->lastop,false,false),dn_escape($dn),$entry_array);
if ($result) {
$tree = get_cached_item($this->server_id,'tree');
$tree->addEntry($dn);
set_cached_item($this->server_id,'tree','null',$tree);
}
return $result;
}
/**
* Modify objects
*/
function modify($dn,$update_array) {
$this->lastop = 'write';
return @ldap_modify($this->connect(true,$this->lastop,false,false),dn_escape($dn),$update_array);
}
/**
* Modify attributes
*/
function attrModify($dn,$update_array) {
$this->lastop = 'write';
return @ldap_mod_add($this->connect(true,$this->lastop,false,false),dn_escape($dn),$update_array);
}
function attrDelete($dn,$update_array) {
$this->lastop = 'write';
return @ldap_mod_del($this->connect(true,$this->lastop,false,false),dn_escape($dn),$update_array);
}
function attrReplace($dn,$update_array) {
$this->lastop = 'write';
return @ldap_mod_replace($this->connect(true,$this->lastop,false,false),dn_escape($dn),$update_array);
}
/**
* Delete objects
*/
function delete($dn) {
if (DEBUG_ENABLED)
debug_log('Entered with (%s)',17,__FILE__,__LINE__,__METHOD__,$dn);
$this->lastop = 'write';
$result = @ldap_delete($this->connect(true,$this->lastop,false,false),dn_escape($dn));
if (DEBUG_ENABLED)
debug_log('Delete Result (%s)',16,__FILE__,__LINE__,__METHOD__,$result);
if ($result) {
$tree = get_cached_item($this->server_id,'tree');
$tree->delEntry($dn);
set_cached_item($this->server_id,'tree','null',$tree);
}
return $result;
}
/**
* Rename objects
*
*/
function rename($dn,$new_rdn,$container,$deleteoldrdn) {
$this->lastop = 'write';
if (! @ldap_rename($this->connect(true,$this->lastop,false,false),$dn,$new_rdn,$container,$deleteoldrdn)) {
pla_error(_('Could not rename the entry'),$this->error(),$this->errno(),false);
} else {
# Update the tree
$tree = get_cached_item($this->server_id,'tree');
$newdn = sprintf('%s,%s',$new_rdn,$container);
$tree->renameEntry($dn, $newdn);
set_cached_item($this->server_id,'tree','null',$tree);
return true;
}
}
/**
* Return error from last operation
* @todo: This may not infact return the right error - especially if a different connect(params) were used.
*/
function error() {
return ldap_error($this->connect(false,$this->lastop));
}
/**
* Return errno from last operation
* @todo: This may not infact return the right error - especially if a different connect(params) were used.
*/
function errno() {
return ldap_errno($this->connect(false,$this->lastop));
}
/**
* Gets whether an entry exists based on its DN. If the entry exists,
* returns true. Otherwise returns false.
*
* If we are not aware of the dn, and a read results in a hit, then
* we'll update the info for the tree.
*
* @param string $dn The DN of the entry of interest.
* @return bool
*/
function dnExists($dn) {
# Set default return
$return = false;
$this->lastop = 'read';
$tree = get_cached_item($this->server_id,'tree');
if (! $tree)
$tree = Tree::getInstance($this->server_id);
$entry_dn = $tree->getEntry($dn);
if ($entry_dn) {
if (DEBUG_ENABLED)
debug_log('Returning CACHED HIT (%s)',17,__FILE__,__LINE__,__METHOD__,$this->server_id,$dn);
return true;
} elseif ($tree->isMissed($dn)) {
if (DEBUG_ENABLED)
debug_log('Returning CACHED MISS (%s)',17,__FILE__,__LINE__,__METHOD__,$this->server_id,$dn);
return false;
# We havent looked for this dn.
} else {
if (DEBUG_ENABLED)
debug_log('Search for (%s) [%s]',16,__FILE__,__LINE__,__METHOD__,$this->server_id,$dn);
# if the entry is not in the tree, we are doing a global search
$search_result = @ldap_read($this->connect(false),dn_escape($dn),'objectClass=*',array('dn'));
if ($search_result) {
$num_entries = ldap_count_entries($this->connect(false),$search_result);
if ($num_entries > 0)
$return = true;
else
$return = false;
} else {
$return = false;
}
}
if (DEBUG_ENABLED)
debug_log('Entered with (%s,%s), Returning (%s)',17,__FILE__,__LINE__,__METHOD__,$this->server_id,$dn,$return);
return $return;
}
/**
* Gets a list of child entries for an entry. Given a DN, this function fetches the list of DNs of
* child entries one level beneath the parent. For example, for the following tree:
*
* <code>
* dc=example,dc=com
* ou=People
* cn=Dave
* cn=Fred
* cn=Joe
* ou=More People
* cn=Mark
* cn=Bob
* </code>
*
* Calling <code>getContainerContents("ou=people,dc=example,dc=com")</code>
* would return the following list:
*
* <code>
* cn=Dave
* cn=Fred
* cn=Joe
* ou=More People
* </code>
*
* @param string $dn The DN of the entry whose children to return.
* @param int $size_limit (optional) The maximum number of entries to return.
* If unspecified, no limit is applied to the number of entries in the returned.
* @param string $filter (optional) An LDAP filter to apply when fetching children, example: "(objectClass=inetOrgPerson)"
* @return array An array of DN strings listing the immediate children of the specified entry.
*/
function getContainerContents($dn,$size_limit=0,$filter='(objectClass=*)',$deref=LDAP_DEREF_ALWAYS) {
if (DEBUG_ENABLED)
debug_log('Entered with (%s,%s,%s,%s)',17,__FILE__,__LINE__,__METHOD__,$dn,$size_limit,$filter,$deref);
$return = array();
$search = $this->search(null,dn_escape($dn),$filter,array('dn'),'one',true,$deref,/*($size_limit > 0 ? $size_limit+1 : $size_limit)*/$size_limit);
if ($search) {
foreach ($search as $searchdn => $entry) {
$child_dn = $entry['dn'];
$return[] = $child_dn;
}
}
if (DEBUG_ENABLED)
debug_log('Returning (%s)',17,__FILE__,__LINE__,__METHOD__,$return);
return $return;
}
/**
* A handy ldap searching function very similar to PHP's ldap_search() with the
* following exceptions: Callers may specify a search scope and the return value
* is an array containing the search results rather than an LDAP result resource.
*
* Example usage:
* <code>
* $samba_users = $ldapserver->search(null,"ou=People,dc=example,dc=com",
* "(&(objectClass=sambaAccount)(objectClass=posixAccount))",
* array("uid","homeDirectory"));
* print_r( $samba_users );
*
* // prints (for example):
* // Array (
* // [uid=jsmith,ou=People,dc=example,dc=com] => Array (
* // [dn] => "uid=jsmith,ou=People,dc=example,dc=com"
* // [uid] => "jsmith"
* // [homeDirectory] => "\\server\jsmith"
* // )
* // [uid=byoung,ou=People,dc=example,dc=com] => Array (
* // [dn] => "uid=byoung,ou=Samba,ou=People,dc=example,dc=com"
* // [uid] => "byoung"
* // [homeDirectory] => "\\server\byoung"
* // )
* // )
* </code>
*
* WARNING: This function will use a lot of memory on large searches since the entire result set is
* stored in a single array. For large searches, you should consider sing the less memory intensive
* PHP LDAP API directly (ldap_search(), ldap_next_entry(), ldap_next_attribute(), etc).
*
* @param resource $resource If an existing LDAP results should be used.
* @param string $filter The LDAP filter to use when searching (example: "(objectClass=*)") (see RFC 2254)
* @param string $base_dn The DN of the base of search.
* @param array $attrs An array of attributes to include in the search result (example: array( "objectClass", "uid", "sn" )).
* @param string $scope The LDAP search scope. Must be one of "base", "one", or "sub". Standard LDAP search scope.
* @param bool $sort_results Specify false to not sort results by DN
* or true to have the returned array sorted by DN (uses ksort)
* or an array of attribute names to sort by attribute values
* @param int $deref When handling aliases or referrals, this specifies whether to follow referrals. Must be one of
* LDAP_DEREF_ALWAYS, LDAP_DEREF_NEVER, LDAP_DEREF_SEARCHING, or LDAP_DEREF_FINDING. See the PHP LDAP API for details.
* @param int $size_limit Size limit for search
*/
function search($resource=null,$base_dn=null,$filter,$attrs=array(),$scope='sub',$sort_results=true,$deref=LDAP_DEREF_NEVER,$size_limit=0) {
if (DEBUG_ENABLED)
debug_log('Entered with (%s,%s,%s,%s,%s,%s,%s)',17,__FILE__,__LINE__,__METHOD__,
is_resource($this),$base_dn,$filter,$attrs,$scope,$sort_results,$deref);
$this->lastop = 'read';
# If we dont have a resource, we'll connect with default settings
if (! is_resource($resource))
$resource = $this->connect(false);
# If the baseDN is null, we'll just search the first DN.
if (is_null($base_dn))
foreach ($this->getBaseDN() as $baseDN) {
$base_dn = $baseDN;
break;
}
if (DEBUG_ENABLED)
debug_log('%s search PREPARE.',16,__FILE__,__LINE__,__METHOD__,$scope);
switch ($scope) {
case 'base':
$search = @ldap_read($resource,$base_dn,$filter,$attrs,0,$size_limit,0,$deref);
break;
case 'one':
$search = @ldap_list($resource,$base_dn,$filter,$attrs,0,$size_limit,0,$deref);
break;
case 'sub':
default:
$search = @ldap_search($resource,$base_dn,$filter,$attrs,0,$size_limit,0,$deref);
break;
}
if (DEBUG_ENABLED)
debug_log('Search scope [%s] base [%s] filter [%s] attrs [%s] COMPLETE (%s).',16,__FILE__,__LINE__,__METHOD__,
$scope,$base_dn,$filter,$attrs,is_null($search));
if (! $search)
return array();
$return = array();
# @todo: this needs to convert everything to lowercase to work.
if (is_array($sort_results))
# we sort with the more important attribute (the first one) at the end
for ($i = count($sort_results) - 1; $i >= 0; --$i)
if (($sort_results[$i] == 'dn') || in_array($sort_results[$i], $attrs))
ldap_sort($resource, $search, $sort_results[$i]);
# Get the first entry identifier
if ($entry_id = ldap_first_entry($resource,$search)) {
# Iterate over the entries
while ($entry_id) {
# Get the distinguished name of the entry
$dn = ldap_get_dn($resource,$entry_id);
if (DEBUG_ENABLED)
debug_log('Got DN [%s].',64,__FILE__,__LINE__,__METHOD__,$dn);
$return[$dn]['dn'] = $dn;
# Get the attributes of the entry
$attrs = ldap_get_attributes($resource,$entry_id);
if (DEBUG_ENABLED)
debug_log('Got ATTRS [%s].',64,__FILE__,__LINE__,__METHOD__,$attrs);
# Get the first attribute of the entry
if ($attr = ldap_first_attribute($resource,$entry_id,$attrs)) {
if (DEBUG_ENABLED)
debug_log('Processing ATTR [%s].',64,__FILE__,__LINE__,__METHOD__,$attr);
# Iterate over the attributes
while ($attr) {
if ($this->isAttrBinary($attr))
$values = ldap_get_values_len($resource,$entry_id,$attr);
else
$values = ldap_get_values($resource,$entry_id,$attr);
# Get the number of values for this attribute
$count = $values['count'];
unset($values['count']);
if ($count == 1)
$return[$dn][$attr] = $values[0];
else
$return[$dn][$attr] = $values;
$attr = ldap_next_attribute($resource,$entry_id,$attrs);
} # end while attr
}
$entry_id = ldap_next_entry($resource,$entry_id);
} # End while entry_id
}
if (($sort_results === true) && is_array($return))
ksort($return);
if (DEBUG_ENABLED)
debug_log('Returning (%s)',17,__FILE__,__LINE__,__METHOD__,$return);
return $return;
}
/**
* Determines if an attribute's value can contain multiple lines. Attributes that fall
* in this multi-line category may be configured in config.php. Hence, this function
* accesses the global variable $_SESSION[APPCONFIG]->custom->appearance['multi_line_attributes'];
*
* Usage example:
* <code>
* if ($ldapserver->isMultiLineAttr('postalAddress'))
* echo "<textarea name=\"postalAddress\"></textarea>";
* else
* echo "<input name=\"postalAddress\" type=\"text\">";
* </code>
*
* @param string $attr_name The name of the attribute of interestd (case insensivite)
* @param string $val (optional) The current value of the attribute (speeds up the
* process by searching for carriage returns already in the attribute value)
* @return bool
*/
function isMultiLineAttr($attr_name,$val=null) {
# Set default return
$return = false;
# First, check the optional val param for a \n or a \r
if (! is_null($val) && (strpos($val,"\n") || strpos($val,"\r")))
$return = true;
# Next, compare strictly by name first
else
foreach ($_SESSION[APPCONFIG]->GetValue('appearance','multi_line_attributes') as $multi_line_attr_name)
if (strcasecmp($multi_line_attr_name,$attr_name) == 0) {
$return = true;
break;
}
# If unfound, compare by syntax OID
if (! $return) {
$schema_attr = $this->getSchemaAttribute($attr_name);
if ($schema_attr) {
$syntax_oid = $schema_attr->getSyntaxOID();
if ($syntax_oid)
foreach ($_SESSION[APPCONFIG]->GetValue('appearance','multi_line_syntax_oids') as $multi_line_syntax_oid)
if ($multi_line_syntax_oid == $syntax_oid) {
$return = true;
break;
}
}
}
if (DEBUG_ENABLED)
debug_log('Entered with (%s,%s), Returning (%s)',17,__FILE__,__LINE__,__METHOD__,$attr_name,$val,$return);
return $return;
}
/**
* Returns true if the attribute specified is required to take as input a DN.
* Some examples include 'distinguishedName', 'member' and 'uniqueMember'.
* @param string $attr_name The name of the attribute of interest (case insensitive)
* @return bool
*/
function isDNAttr($attr_name) {
if (DEBUG_ENABLED)
debug_log('Entered with (%s)',17,__FILE__,__LINE__,__METHOD__,$attr_name);
# Simple test first
$dn_attrs = array('aliasedObjectName');
foreach ($dn_attrs as $dn_attr)
if (strcasecmp($attr_name,$dn_attr) == 0)
return true;
# Now look at the schema OID
$attr_schema = $this->getSchemaAttribute($attr_name);
if (! $attr_schema)
return false;
$syntax_oid = $attr_schema->getSyntaxOID();
if ('1.3.6.1.4.1.1466.115.121.1.12' == $syntax_oid)
return true;
if ('1.3.6.1.4.1.1466.115.121.1.34' == $syntax_oid)
return true;
$syntaxes = $this->SchemaSyntaxes();
if (! isset($syntaxes[$syntax_oid]))
return false;
$syntax_desc = $syntaxes[ $syntax_oid ]->getDescription();
if (strpos(strtolower($syntax_desc),'distinguished name'))
return true;
return false;
}
/**
* Responsible for setting two cookies/session-vars to indicate that a user has logged in,
* one for the logged in DN and one for the logged in password.
*
* This function is only used if 'auth_type' is set to 'cookie' or 'session'. The values
* written have the name "pla_login_dn_X" and "pla_login_pass_X" where X is the
* ID of the server to which the user is attempting login.
*
* Note that as with all cookie/session operations this function must be called BEFORE
* any output is sent to the browser.
*
* On success, true is returned. On failure, false is returned.
*
* @param string $dn The DN with which the user has logged in.
* @param string $password The password of the user logged in.
* @param bool $anon_bind Indicates that this is an anonymous bind such that
* a password of "0" is stored.
* @return bool
* @see unsetLoginDN
*/
function setLoginDN($dn,$password,$anon_bind) {
if (DEBUG_ENABLED)
debug_log('Entered with (%s,%s,%s)',17,__FILE__,__LINE__,__METHOD__,$dn,$password,$anon_bind);
if (! $this->auth_type)
return false;
switch ($this->auth_type) {
case 'cookie':
$cookie_dn_name = sprintf('pla_login_dn_%s',$this->server_id);
$cookie_pass_name = sprintf('pla_login_pass_%s',$this->server_id);
# we set the cookie password to 0 for anonymous binds.
if ($anon_bind) {
$dn = 'anonymous';
$password = '0';
}
$res1 = pla_set_cookie($cookie_dn_name,pla_blowfish_encrypt($dn));
$res2 = pla_set_cookie($cookie_pass_name,pla_blowfish_encrypt($password));
if ($res1 && $res2)
return true;
else
return false;
break;
case 'session':
$sess_var_dn_name = sprintf('pla_login_dn_%s',$this->server_id);
$sess_var_pass_name = sprintf('pla_login_pass_%s',$this->server_id);
# we set the cookie password to 0 for anonymous binds.
if ($anon_bind) {
$dn = 'anonymous';
$password = '0';
}
$_SESSION[$sess_var_dn_name] = pla_blowfish_encrypt($dn);
$_SESSION[$sess_var_pass_name] = pla_blowfish_encrypt($password);
return true;
break;
default:
pla_error(sprintf(_('Unknown auth_type: %s'),htmlspecialchars($this->auth_type)));
break;
}
}
/**
* Log a user out of the LDAP server.
*
* Removes the cookies/session-vars set by setLoginDN()
* after a user logs out using "auth_type" of "session" or "cookie".
* Returns true on success, false on failure.
*
* @return bool True on success, false on failure.
* @see setLoginDN
*/
function unsetLoginDN() {
if (DEBUG_ENABLED)
debug_log('Entered with ()',17,__FILE__,__LINE__,__METHOD__);
if (! $this->auth_type)
return false;
switch ($this->auth_type) {
case 'cookie':
$logged_in_dn = $this->getLoggedInDN();
if (! $logged_in_dn)
return false;
$logged_in_pass = $this->getLoggedInPass();
$anon_bind = $logged_in_dn == 'anonymous' ? true : false;
# set cookie with expire time already passed to erase cookie from client
$expire = time()-3600;
$cookie_dn_name = sprintf('pla_login_dn_%s',$this->server_id);
$cookie_pass_name = sprintf('pla_login_pass_%s',$this->server_id);
if ($anon_bind) {
$res1 = pla_set_cookie($cookie_dn_name,'anonymous',$expire);
$res2 = pla_set_cookie($cookie_pass_name,'0',$expire);
} else {
$res1 = pla_set_cookie($cookie_dn_name,pla_blowfish_encrypt($logged_in_dn),$expire);
$res2 = pla_set_cookie($cookie_pass_name,pla_blowfish_encrypt($logged_in_pass),$expire);
}
# Need to unset the cookies too, since they are still set if further processing occurs (eg: Timeout)
unset($_COOKIE[$cookie_dn_name]);
unset($_COOKIE[$cookie_pass_name]);
if (! $res1 || ! $res2)
return false;
else
return true;
break;
case 'session':
# unset session variables
$session_var_dn_name = sprintf('pla_login_dn_%s',$this->server_id);
$session_var_pass_name = sprintf('pla_login_pass_%s',$this->server_id);
if (array_key_exists($session_var_dn_name,$_SESSION))
unset($_SESSION[$session_var_dn_name]);
if (array_key_exists($session_var_pass_name,$_SESSION))
unset($_SESSION[$session_var_pass_name]);
return true;
break;
default:
pla_error(sprintf(_('Unknown auth_type: %s'),htmlspecialchars($auth_type)));
break;
}
}
/**
* Used to determine if the specified attribute is indeed a jpegPhoto. If the
* specified attribute is one that houses jpeg data, true is returned. Otherwise
* this function returns false.
*
* @param string $attr_name The name of the attribute to test.
* @return bool
* @see draw_jpeg_photos
*/
function isJpegPhoto($attr_name) {
if (DEBUG_ENABLED)
debug_log('Entered with (%s)',17,__FILE__,__LINE__,__METHOD__,$attr_name);
# easy quick check
if (! strcasecmp($attr_name,'jpegPhoto') || ! strcasecmp($attr_name,'photo'))
return true;
# go to the schema and get the Syntax OID
$schema_attr = $this->getSchemaAttribute($attr_name);
if (! $schema_attr)
return false;
$oid = $schema_attr->getSyntaxOID();
$type = $schema_attr->getType();
if (! strcasecmp($type,'JPEG') || ($oid == '1.3.6.1.4.1.1466.115.121.1.28'))
return true;
return false;
}
/**
* Given an attribute name and server ID number, this function returns
* whether the attrbiute contains boolean data. This is useful for
* developers who wish to display the contents of a boolean attribute
* with a drop-down.
*
* @param string $attr_name The name of the attribute to test.
* @return bool
*/
function isAttrBoolean($attr_name) {
if (DEBUG_ENABLED)
debug_log('Entered with (%s)',17,__FILE__,__LINE__,__METHOD__,$attr_name);
$type = ($schema_attr = $this->getSchemaAttribute($attr_name)) ? $schema_attr->getType() : null;
if (! strcasecmp('boolean',$type ) ||
! strcasecmp('isCriticalSystemObject',$attr_name) ||
! strcasecmp('showInAdvancedViewOnly',$attr_name))
return true;
else
return false;
}
/**
* Given an attribute name and server ID number, this function returns
* whether the attrbiute may contain binary data. This is useful for
* developers who wish to display the contents of an arbitrary attribute
* but don't want to dump binary data on the page.
*
* @param string $attr_name The name of the attribute to test.
* @return bool
*
* @see isJpegPhoto
*/
function isAttrBinary($attr_name) {
if (DEBUG_ENABLED)
debug_log('Entered with (%s)',17,__FILE__,__LINE__,__METHOD__,$attr_name);
/**
* Determining if an attribute is binary can be an expensive operation.
* We cache the results for each attr name on each server in the $attr_cache
* to speed up subsequent calls. The $attr_cache looks like this:
*
* Array
* 0 => Array
* 'objectclass' => false
* 'cn' => false
* 'usercertificate' => true
* 1 => Array
* 'jpegphoto' => true
* 'cn' => false
*/
static $attr_cache;
$attr_name = strtolower($attr_name);
if (isset($attr_cache[$this->server_id][$attr_name]))
return $attr_cache[$this->server_id][$attr_name];
if ($attr_name == 'userpassword') {
$attr_cache[$this->server_id][$attr_name] = false;
return false;
}
# Quick check: If the attr name ends in ";binary", then it's binary.
if (strcasecmp(substr($attr_name,strlen($attr_name) - 7),';binary') == 0) {
$attr_cache[$this->server_id][$attr_name] = true;
return true;
}
# See what the server schema says about this attribute
$schema_attr = $this->getSchemaAttribute($attr_name);
if (! $schema_attr) {
/* Strangely, some attributeTypes may not show up in the server
* schema. This behavior has been observed in MS Active Directory.*/
$type = null;
$syntax = null;
} else {
$type = $schema_attr->getType();
$syntax = $schema_attr->getSyntaxOID();
}
if (strcasecmp($type,'Certificate') == 0 ||
strcasecmp($type,'Binary') == 0 ||
strcasecmp($attr_name,'usercertificate') == 0 ||
strcasecmp($attr_name,'usersmimecertificate') == 0 ||
strcasecmp($attr_name,'networkaddress') == 0 ||
strcasecmp($attr_name,'objectGUID') == 0 ||
strcasecmp($attr_name,'objectSID') == 0 ||
$syntax == '1.3.6.1.4.1.1466.115.121.1.10' ||
$syntax == '1.3.6.1.4.1.1466.115.121.1.28' ||
$syntax == '1.3.6.1.4.1.1466.115.121.1.5' ||
$syntax == '1.3.6.1.4.1.1466.115.121.1.8' ||
$syntax == '1.3.6.1.4.1.1466.115.121.1.9'
) {
$attr_cache[$this->server_id][$attr_name] = true;
return true;
} else {
$attr_cache[$this->server_id][$attr_name] = false;
return false;
}
}
/**
* Returns true if the specified attribute is configured as read only
* in config.php with the $read_only_attrs array.
* Attributes are configured as read-only in config.php thus:
* <code>
* $read_only_attrs = array( "objectClass", "givenName" );
* </code>
*
* @param string $attr The name of the attribute to test.
* @return bool
*/
function isAttrReadOnly($attr) {
if (DEBUG_ENABLED)
debug_log('Entered with (%s)',17,__FILE__,__LINE__,__METHOD__,$attr);
$read_only_attrs = isset($_SESSION[APPCONFIG]->read_only_attrs) ? $_SESSION[APPCONFIG]->read_only_attrs : array();
$read_only_except_dn = isset($_SESSION[APPCONFIG]->read_only_except_dn) ? $_SESSION[APPCONFIG]->read_only_except_dn : '';
$attr = trim($attr);
if (! $attr)
return false;
if (! isset($read_only_attrs))
return false;
if (! is_array($read_only_attrs))
return false;
# Is the user excluded?
if (isset($read_only_except_dn) && $read_only_except_dn && $this->userIsMember($this->getLoggedInDN(),$read_only_except_dn))
return false;
foreach ($read_only_attrs as $attr_name)
if (strcasecmp($attr,trim($attr_name)) == 0)
return true;
return false;
}
/**
* Returns true if the specified attribute is configured as hidden
* in config.php with the $hidden_attrs array or the $hidden_attrs_ro
* array.
* Attributes are configured as hidden in config.php thus:
* <code>
* $hidden_attrs = array( "objectClass", "givenName" );
* </code>
* or
* <code>
* $hidden_attrs_ro = array( "objectClass", "givenName", "shadowWarning",
* "shadowLastChange", "shadowMax", "shadowFlag",
* "shadowInactive", "shadowMin", "shadowExpire" );
* </code>
*
* @param string $attr The name of the attribute to test.
* @return bool
*/
function isAttrHidden($attr) {
if (DEBUG_ENABLED)
debug_log('Entered with (%s)',17,__FILE__,__LINE__,__METHOD__,$attr);
$hidden_attrs = isset($_SESSION[APPCONFIG]->hidden_attrs) ? $_SESSION[APPCONFIG]->hidden_attrs : array();
$hidden_attrs_ro = isset($_SESSION[APPCONFIG]->hidden_attrs_ro) ? $_SESSION[APPCONFIG]->hidden_attrs_ro : array();
$hidden_except_dn = isset($_SESSION[APPCONFIG]->hidden_except_dn) ? $_SESSION[APPCONFIG]->hidden_except_dn : '';
$attr = trim($attr);
if (! $attr)
return false;
if (! isset($hidden_attrs))
return false;
if (! is_array($hidden_attrs))
return false;
if (! isset($hidden_attrs_ro))
$hidden_attrs_ro = $hidden_attrs;
if (! is_array($hidden_attrs_ro))
$hidden_attrs_ro = $hidden_attrs;
# Is the user excluded?
if (isset($hidden_except_dn) && $hidden_except_dn && $this->userIsMember($this->getLoggedInDN(),$hidden_except_dn))
return false;
if ($this->isReadOnly()) {
foreach ($hidden_attrs_ro as $attr_name)
if (strcasecmp($attr,trim($attr_name)) == 0)
return true;
} else {
foreach ($hidden_attrs as $attr_name)
if (strcasecmp($attr,trim($attr_name)) == 0)
return true;
}
return false;
}
/**
* Fetches the password of the currently logged in user (for auth_types "cookie", "session" and "http" only)
* or false if the current login is anonymous.
*
* @return string
* @see have_auth_info
* @see getLoggedInDN
*/
function getLoggedInPass() {
if (DEBUG_ENABLED)
debug_log('Entered with ()',17,__FILE__,__LINE__,__METHOD__);
if (! $this->auth_type)
return false;
switch ($this->auth_type) {
case 'cookie':
$cookie_name = sprintf('pla_login_pass_%s',$this->server_id);
$pass = isset($_COOKIE[$cookie_name]) ? $_COOKIE[$cookie_name] : false;
if ($pass == '0')
return null;
else
return pla_blowfish_decrypt($pass);
break;
case 'session':
$session_var_name = sprintf('pla_login_pass_%s',$this->server_id);
$pass = isset($_SESSION[$session_var_name]) ? $_SESSION[$session_var_name] : false;
if ($pass == '0')
return null;
else
return pla_blowfish_decrypt($pass);
break;
case 'http':
$pass = isset($_SERVER['PHP_AUTH_PW']) ? $_SERVER['PHP_AUTH_PW'] : false;
if ($pass == '0')
return null;
else
return $pass;
break;
case 'config':
return $this->login_pass;
break;
default:
pla_error(sprintf(_('Unknown auth_type: %s'),htmlspecialchars($this->auth_type)));
}
}
/**
* Returns the DN who is logged in currently to the given server, which may
* either be a DN or the string 'anonymous'. This applies only for auth_types
* "cookie", "session" and "http".
*
* One place where this function is used is the tree viewer:
* After a user logs in, the text "Logged in as: " is displayed under the server
* name. This information is retrieved from this function.
*
* @return string
* @see have_auth_info
* @see getLoggedInPass
*/
function getLoggedInDN() {
# Set default return
$return = false;
if (DEBUG_ENABLED)
debug_log('auth_type is [%s]',66,__FILE__,__LINE__,__METHOD__,$this->auth_type);
if ($this->auth_type) {
switch ($this->auth_type) {
case 'cookie':
$cookie_name = sprintf('pla_login_dn_%s',$this->server_id);
if (isset($_COOKIE[$cookie_name]))
$return = pla_blowfish_decrypt($_COOKIE[$cookie_name]);
else
$return = false;
break;
case 'session':
$session_var_name = sprintf('pla_login_dn_%s',$this->server_id);
if (isset($_SESSION[$session_var_name]))
$return = pla_blowfish_decrypt($_SESSION[$session_var_name]);
else
$return = false;
break;
case 'http':
if (isset($_SERVER['PHP_AUTH_USER']))
{
if ($this->isLoginAttrEnabled()) {
if ($this->isLoginStringEnabled()) {
$return = str_replace('<username>',$_SERVER['PHP_AUTH_USER'],$this->getLoginString());
} else {
if ($this->login_dn)
$this->connect(true,'user',false,true,$this->login_dn,$this->login_pass);
else
$this->connect(true,'anonymous');
if (! empty($this->login_class))
$filter = sprintf('(&(objectClass=%s)(%s=%s))',
$this->login_class,$this->getLoginAttr(),$_SERVER['PHP_AUTH_USER']);
else
$filter = sprintf('%s=%s',$this->getLoginAttr(),$_SERVER['PHP_AUTH_USER']);
foreach ($this->getBaseDN() as $base_dn) {
$result = $this->search(null,$base_dn,$filter,array('dn'));
$result = array_pop($result);
$return = $result['dn'];
if ($return) break;
}
}
} else {
$return = $_SERVER['PHP_AUTH_USER'];
}
}
else
$return = false;
if ($return) {
$dn = $return;
$pass = '';
if (isset($_SERVER['PHP_AUTH_PW'])) $pass = $_SERVER['PHP_AUTH_PW'];
if ($this->userIsAllowedLogin($dn)) {
$ds = $this->connect(false,'user',true,true,$dn,$pass);
if (! is_resource($ds)) {
system_message(array(
'title'=>_('Authenticate to server'),
'body'=>_('Bad username or password. Please try again.'),
'type'=>'error'),
sprintf('cmd.php?cmd=login_form&server_id=%s',$this->server_id));
syslog_notice("Authentification FAILED for $dn");
}
$this->auth_type = 'config';
$this->login_dn = $dn;
$this->login_pass = $pass;
} else {
$this->auth_type = 'session';
$return = false;
}
}
break;
case 'config':
$return = $this->login_dn;
break;
default:
pla_error(sprintf(_('Unknown auth_type: %s'),htmlspecialchars($auth_type)));
}
}
if (DEBUG_ENABLED)
debug_log('Entered with (), Returning (%s)',17,__FILE__,__LINE__,__METHOD__,$return);
return $return;
}
/**
* Gets the operational attributes for an entry. Given a DN, this function fetches that entry's
* operational (ie, system or internal) attributes. These attributes include "createTimeStamp",
* "creatorsName", and any other attribute that the LDAP server sets automatically. The returned
* associative array is of this form:
* <code>
* Array (
* [creatorsName] => Array (
* [0] => "cn=Admin,dc=example,dc=com"
* )
* [createTimeStamp]=> Array (
* [0] => "10401040130"
* )
* [hasSubordinates] => Array (
* [0] => "FALSE"
* )
* )
* </code>
*
* @param string $dn The DN of the entry whose interal attributes are desired.
* @param int $deref For aliases and referrals, this parameter specifies whether to
* follow references to the referenced DN or to fetch the attributes for
* the referencing DN. See http://php.net/ldap_search for the 4 valid
* options.
* @return array An associative array whose keys are attribute names and whose values
* are arrays of values for the aforementioned attribute.
*/
function getDNSysAttrs($dn,$deref=LDAP_DEREF_NEVER) {
if (DEBUG_ENABLED)
debug_log('Entered with (%s,%s)',17,__FILE__,__LINE__,__METHOD__,$dn,$deref);
$attrs = array('creatorsname','createtimestamp','modifiersname',
'structuralObjectClass','entryUUID','modifytimestamp',
'subschemaSubentry','hasSubordinates','+');
$search = $this->search(null,$dn,'(objectClass=*)',$attrs,'base',false,$deref);
$return_attrs = array();
foreach ($search as $dn => $attrs)
foreach ($attrs as $attr => $value) {
if (is_array($value)) {
foreach ($value as $val) $return_attrs[$attr][] = $val;
} else {
$return_attrs[$attr][] = $value;
}
}
return $return_attrs;
}
/**
* Gets the attributes/values of an entry. Returns an associative array whose
* keys are attribute value names and whose values are arrays of values for
* said attribute. Optionally, callers may specify true for the parameter
* $lower_case_attr_names to force all keys in the associate array (attribute
* names) to be lower case.
*
* Sample return value of <code>getDNAttrs( 0, "cn=Bob,ou=pepole,dc=example,dc=com" )</code>
*
* <code>
* Array (
* [objectClass] => Array (
* [0] => person
* [1] => top
* )
* [cn] => Array (
* [0] => Bob
* )
* [sn] => Array (
* [0] => Jones
* )
* [dn] => Array (
* [0] => cn=Bob,ou=pepole,dc=example,dc=com
* )
* )
* </code>
*
* @param string $dn The distinguished name (DN) of the entry whose attributes/values to fetch.
* @param bool $lower_case_attr_names (optional) If true, all keys of the returned associative
* array will be lower case. Otherwise, they will be cased as the LDAP server returns
* them.
* @param int $deref For aliases and referrals, this parameter specifies whether to
* follow references to the referenced DN or to fetch the attributes for
* the referencing DN. See http://php.net/ldap_search for the 4 valid
* options.
* @return array
* @see getDNSysAttrs
* @see getDNAttr
*/
function getDNAttrs($dn,$lower_case_attr_names=false,$deref=LDAP_DEREF_NEVER) {
global $CACHE;
if (DEBUG_ENABLED)
debug_log('Entered with (%s,%s,%s)',17,__FILE__,__LINE__,__METHOD__,$dn,$lower_case_attr_names,$deref);
$attrs = null;
if (isset($CACHE['dnattrs'][$dn])) {
if (DEBUG_ENABLED)
debug_log('Entered with (%s,%s,%s), Returning CACHED (%s)',17,__FILE__,__LINE__,__METHOD__,
$dn,$lower_case_attr_names,$deref,$CACHE['dnattrs'][$dn]);
$attrs = $CACHE['dnattrs'][$dn];
} else {
$attrs = $this->search(null,dn_escape($dn),'(objectClass=*)',array(),'base',false,$deref);
if (count($attrs))
$attrs = array_pop($attrs);
foreach ($attrs as $key => $values)
if (! is_array($attrs[$key]))
$attrs[$key] = array($attrs[$key]);
$CACHE['dnattrs'][$dn] = $attrs;
}
if ($lower_case_attr_names)
$attrs = array_change_key_case($attrs);
return $attrs;
}
/**
* Much like getDNAttrs(), but only returns the values for
* one attribute of an object. Example calls:
*
* <code>
* print_r( getDNAttr( 0, "cn=Bob,ou=people,dc=example,dc=com", "sn" ) );
* Array (
* [0] => "Smith"
* )
*
* print_r( getDNAttr( 0, "cn=Bob,ou=people,dc=example,dc=com", "objectClass" ) );
* Array (
* [0] => "top"
* [1] => "person"
* )
* </code>
*
* @param string $dn The distinguished name (DN) of the entry whose attributes/values to fetch.
* @param string $attr The attribute whose value(s) to return (ie, "objectClass", "cn", "userPassword")
* @param bool $lower_case_attr_names (optional) If true, all keys of the returned associative
* array will be lower case. Otherwise, they will be cased as the LDAP server returns
* them.
* @param int $deref For aliases and referrals, this parameter specifies whether to
* follow references to the referenced DN or to fetch the attributes for
* the referencing DN. See http://php.net/ldap_search for the 4 valid
* options.
* @see getDNAttrs
* @return array
*/
function getDNAttr($dn,$attr,$lower_case_attr_names=false,$deref=LDAP_DEREF_NEVER) {
if (DEBUG_ENABLED)
debug_log('Entered with (%s,%s,%s,%s)',17,__FILE__,__LINE__,__METHOD__,$dn,$attr,$lower_case_attr_names,$deref);
if ($lower_case_attr_names)
$attr = strtolower($attr);
$attrs = $this->getDNAttrs($dn,$lower_case_attr_names,$deref);
if (isset($attrs[$attr]))
return $attrs[$attr];
else
return array();
}
/**
* Given a DN string, this returns the top container portion of the string.
* @param string $dn The DN whose container string to return.
* @return string The container
* @see get_rdn
* @see get_container
*/
function getContainerTop($dn) {
$return = $dn;
foreach ($this->getBaseDN() as $base_dn) {
if (preg_match("/${base_dn}$/",$dn)) {
$return = $base_dn;
break;
}
}
if (DEBUG_ENABLED)
debug_log('Entered with (%s), Returning (%s)',17,__FILE__,__LINE__,__METHOD__,$dn,$return);
return $return;
}
/**
* Given a DN string and a path like syntax, this returns the parent container portion of the string.
* @param string $dn The DN whose container string to return.
* @param string $path Either '/', '.' or something like '../../<rdn>'
* @return string The container
* @see get_rdn
* @see get_container
*/
function getContainerParent($container,$path) {
if (DEBUG_ENABLED)
debug_log('Entered with (%s,%s)',17,__FILE__,__LINE__,__METHOD__,$container,$path);
$top = $this->getContainerTop($container);
if ($path[0] == '/') {
$container = $top;
$path = substr($path, 1);
} elseif ($path == '.') {
return $container;
}
$parenttree = explode('/',$path);
foreach ($parenttree as $index => $value) {
if ($value == '..') {
if (get_container($container))
$container = get_container($container);
if ($container == $top)
break;
} elseif($value) {
$container = "$value,$container";
} else {
break;
}
}
return $container;
}
/**
* Determins if the specified attribute is contained in the $unique_attrs list
* configured in config.php.
* @return bool True if the specified attribute is in the $unique_attrs list and false
* otherwise.
*/
function isUniqueAttr($attr_name) {
if (DEBUG_ENABLED)
debug_log('Entered with (%s)',17,__FILE__,__LINE__,__METHOD__,$attr_name);
$unique_attrs = isset($_SESSION[APPCONFIG]->unique_attrs) ? $_SESSION[APPCONFIG]->unique_attrs : array();
if (isset($unique_attrs) && is_array($unique_attrs))
foreach ($unique_attrs as $attr)
if (strcasecmp($attr_name,$attr) == 0)
return true;
return false;
}
/**
* This function will check whether the value for an attribute being changed
* is already assigned to another DN.
*
* Inputs:
* @param dn $dn DN that is being changed
* @param string $attr_name Attribute being changed
* @param string|array $new values New values for the attribute
*
* Returns the bad value, or null if all values are OK
*/
function checkUniqueAttr($dn,$attr_name,$new_value) {
if (DEBUG_ENABLED)
debug_log('Entered with (%s,%s,%s)',17,__FILE__,__LINE__,__METHOD__,
$dn,$attr_name,count($new_value));
# Is this attribute in the unique_attrs list?
if ($this->isUniqueAttr($attr_name)) {
$con = $this->connect(false,'unique_attr',false,true,
$_SESSION[APPCONFIG]->ldapservers->GetValue($this->server_id,'unique_attrs','dn'),
$_SESSION[APPCONFIG]->ldapservers->GetValue($this->server_id,'unique_attrs','pass'));
if (! $con)
pla_error(sprintf(_('Unable to bind to <b>%s</b> with your with unique_attrs credentials. Please check your configuration file.'),$this->name));
# Build our search filter to double check each attribute.
$searchfilter = '(|';
if (is_array($new_value))
foreach ($new_value as $val)
$searchfilter .= sprintf('(%s=%s)',$attr_name,clean_search_vals($val));
elseif ($new_value)
$searchfilter .= sprintf('(%s=%s)',$attr_name,clean_search_vals($new_value));
$searchfilter .= ')';
# Do we need a sanity check to just in case $new_value was null and hence the search string is bad?
foreach ($this->getBaseDN() as $base_dn) {
# Do the search
$search = $this->search($con,$base_dn,$searchfilter,array('dn',$attr_name),'sub',false,LDAP_DEREF_ALWAYS);
foreach ($search as $searchdn => $result)
# If one of the attributes is owned to somebody else, then we may as well die here.
if ($result['dn'] != $dn)
if (is_array($result[$attr_name])) {
foreach ($result[$attr_name] as $attr)
foreach ($new_value as $new_value_attr)
if ($new_value_attr == $attr)
return $attr;
} else {
foreach ($new_value as $new_value_attr)
if ($new_value_attr == $result[$attr_name])
return $result[$attr_name];
}
}
# If we get here, then it must be OK?
return;
} else {
return;
}
}
/**
* This function will test if a user is a member of a group.
*
* Inputs:
* @param string $user membership value that is being checked
* @param dn $group DN to see if user is a member
* @return bool true|false
*/
function userIsMember($user,$group) {
if (DEBUG_ENABLED)
debug_log('Entered with (%s,%s)',17,__FILE__,__LINE__,__METHOD__,$user,$group);
$user = strtolower($user);
$group = $this->getDNAttrs($group,false,$deref=LDAP_DEREF_NEVER);
if (is_array($group)) {
$group = array_change_key_case($group);
# If you are using groupOfNames objectClass
if (array_key_exists('member',$group) && ! is_array($group['member']))
$group['member'] = array($group['member']);
if (array_key_exists('member',$group) &&
in_array($user,arrayLower($group['member'])))
return true;
# If you are using groupOfUniqueNames objectClass
if (array_key_exists('uniquemember',$group) && ! is_array($group['uniquemember']))
$group['uniquemember'] = array($group['uniquemember']);
if (array_key_exists('uniquemember',$group) &&
in_array($user,arrayLower($group['uniquemember'])))
return true;
}
return false;
}
/**
*/
function userIsAllowedLogin($user) {
if (DEBUG_ENABLED)
debug_log('Entered with (%s)',17,__FILE__,__LINE__,__METHOD__,$user);
$user = trim(strtolower($user));
if (! $_SESSION[APPCONFIG]->ldapservers->GetValue($this->server_id,'login','allowed_dns'))
return true;
foreach ($_SESSION[APPCONFIG]->ldapservers->GetValue($this->server_id,'login','allowed_dns') as $login_allowed_dn) {
if (DEBUG_ENABLED)
debug_log('Working through (%s)',80,__FILE__,__LINE__,__METHOD__,$login_allowed_dn);
/* Check if $login_allowed_dn is an ldap search filter
* Is first occurence of 'filter=' (case ensitive) at position 0 ? */
if (preg_match('/^\([&|]\(/',$login_allowed_dn)) {
$filter = $login_allowed_dn;
foreach($this->getBaseDN() as $base_dn) {
$dn_array = array();
$results = $this->search(null,$base_dn,$filter,array('dn'));
if (DEBUG_ENABLED)
debug_log('Search, Filter [%s], BaseDN [%s] Results [%s]',16,__FILE__,__LINE__,__METHOD__,
$filter, $base_dn,$results);
if ($results) {
foreach ($results as $result)
$dn_array[] = $result['dn'];
$dn_array = array_unique($dn_array);
if (count($dn_array) !== 0)
foreach ($dn_array as $result_dn) {
if (DEBUG_ENABLED)
debug_log('Comparing with [%s]',80,__FILE__,__LINE__,__METHOD__,$result_dn);
# Check if $result_dn is a user DN
if (strcasecmp($user,trim(strtolower($result_dn))) == 0)
return true;
# Check if $result_dn is a group DN
if ($this->userIsMember($user,$result_dn))
return true;
}
}
}
}
# Check if $login_allowed_dn is a user DN
if (strcasecmp($user,trim(strtolower($login_allowed_dn))) == 0)
return true;
# Check if $login_allowed_dn is a group DN
if ( $this->userIsMember($user,$login_allowed_dn) )
return true;
}
return false;
}
/**
* Get the LDAP base DN for a named DN.
*
* @param string $dn DN in question
* @return string $base_dn
*/
function getDNBase($dn) {
foreach ($this->getBaseDN() as $base_dn) {
if (preg_match('/'.$base_dn.'$/',$dn))
return $base_dn;
}
return null;
}
}
class LDAPservers {
/* All LDAP servers */
var $_ldapservers;
/* Default settings for a new LDAP server configuration. */
var $default;
function LDAPservers() {
$this->default = new StdClass;
$this->default->server['name'] = array(
'desc'=>'Server name',
'var'=>'name',
'default'=>'LDAP Server');
$this->default->server['host'] = array(
'desc'=>'Host Name',
'var'=>'host',
'default'=>'127.0.0.1');
$this->default->server['port'] = array(
'desc'=>'Port Number',
'var'=>'port',
'default'=>'389');
/* Normally PLA will direct all read/write operations to host/port above. However,
* if you specify hostwr/portwr, then write operations will be directed to that host/port.
* Keep in mind, PLA is unaware that they may be two separate hosts and replication delays. */
$this->default->server['hostwr'] = array(
'desc'=>'Host Name for write replica',
'var'=>'hostwr',
'default'=>null);
$this->default->server['portwr'] = array(
'desc'=>'Port Number for write replica',
'var'=>'portwr',
'default'=>'389');
$this->default->server['base'] = array(
'desc'=>'Base DN',
'default'=>array());
$this->default->server['tls'] = array(
'desc'=>'Connect using TLS',
'var'=>'tls',
'default'=>false);
$this->default->server['auth_type'] = array(
'desc'=>'Authentication Type',
'var'=>'auth_type',
'default'=>'cookie');
$this->default->server['low_bandwidth'] = array(
'desc'=>'Enable LOW Bandwidth optimisations',
'var'=>'low_bandwidth',
'default'=>false);
$this->default->server['read_only'] = array(
'desc'=>'Server is in READ ONLY mode',
'var'=>'read_only',
'default'=>false);
$this->default->server['branch_rename'] = array(
'desc'=>'Permit renaming branches',
'var'=>'branch_rename',
'default'=>false);
/* This was created for IDS - since it doesnt present STRUCTURAL against objectClasses
* definitions when reading the schema.*/
$this->default->server['schema_oclass_default'] = array(
'desc'=>'When reading the schema, and it doesnt specify objectClass type, default it to this',
'var'=>'schema_oclass_default',
'default'=>null);
$this->default->login['dn'] = array(
'desc'=>'User Login DN',
'var'=>'login_dn',
'default'=>'');
$this->default->login['pass'] = array(
'desc'=>'User Login Password',
'var'=>'login_pass',
'default'=>'');
$this->default->login['attr'] = array(
'desc'=>'Attribute to use to find the users DN',
'var'=>'login_attr',
'default'=>'dn');
$this->default->login['fallback_dn'] = array(
'desc'=>'Enable fallback to dn when using attr != dn',
'var'=>'login_fallback_dn',
'default'=>false);
$this->default->login['class'] = array(
'desc'=>'Strict login to users containing a specific objectClass',
'default'=>null);
$this->default->login['string'] = array(
'desc'=>'Login string if using auth_type=string',
'var'=>'login_string',
'default'=>null);
$this->default->login['anon_bind'] = array(
'desc'=>'Whether to allow anonymous binds',
'default'=>true);
$this->default->login['allowed_dns'] = array(
'desc'=>'Limit logins to users who match any of the following LDAP filters',
'default'=>array());
$this->default->login['timeout'] = array(
'desc'=>'Session timout in seconds',
'var'=>'session_timeout',
'default'=>session_cache_expire()-1);
$this->default->appearance['password_hash'] = array(
'desc'=>'Default HASH to use for passwords',
'var'=>'default_hash',
'default'=>'md5');
$this->default->appearance['show_create'] = array(
'desc'=>'Show CREATE options in the tree',
'var'=>'show_create',
'default'=>true);
$this->default->appearance['visible'] = array(
'desc'=>'Whether this LDAP server is visible in the tree',
'var'=>'visible',
'default'=>true);
$this->default->auto_number['enable'] = array(
'desc'=>'Enable the AUTO UID feature',
'default'=>true);
$this->default->auto_number['mechanism'] = array(
'desc'=>'Mechanism to use to search for automatic numbers',
'default'=>'search');
$this->default->auto_number['search_base'] = array(
'desc'=>'Base DN to use for search mechanisms',
'default'=>null);
$this->default->auto_number['min'] = array(
'desc'=>'Minimum UID number to start with',
'default'=>1000);
$this->default->auto_number['dn'] = array(
'desc'=>'DN to use when evaluating numbers',
'default'=>null);
$this->default->auto_number['pass'] = array(
'desc'=>'Password for DN to use when evaluating numbers',
'default'=>null);
$this->default->unique_attrs['dn'] = array(
'desc'=>'DN to use when evaluating uniqueness',
'default'=>null);
$this->default->unique_attrs['pass'] = array(
'desc'=>'Password for DN to use when evaluating uniqueness',
'default'=>null);
$this->default->custom['pages_prefix'] = array(
'desc'=>'Path to custom pages',
'default'=>null);
$this->default->server['sasl_auth'] = array(
'desc' => 'Use SASL authentication when binding LDAP server',
'var' => 'sasl_auth',
'default' => false);
$this->default->server['sasl_mech'] = array(
'desc' => 'SASL mechanism used while binding LDAP server',
'var' => 'sasl_mech',
'default' => 'PLAIN');
$this->default->server['sasl_realm'] = array(
'desc' => 'SASL realm name',
'var' => 'sasl_realm',
'default' => '');
$this->default->server['sasl_authz_id'] = array(
'desc' => 'SASL authorization id',
'var' => 'sasl_authz_id',
'default' => '');
$this->default->server['sasl_authz_id_regex'] = array(
'desc' => 'SASL authorization id PCRE regular expression',
'var' => 'sasl_authz_id_regex',
'default' => null);
$this->default->server['sasl_authz_id_replacement'] = array(
'desc' => 'SASL authorization id PCRE regular expression replacement string',
'var' => 'sasl_authz_id_replacement',
'default' => null);
$this->default->server['sasl_props'] = array(
'desc' => 'SASL properties',
'var' => 'sasl_props',
'default' => null);
}
function SetValue($server_id,$key,$index,$value) {
if (defined('DEBUG_ENABLED') && (DEBUG_ENABLED))
debug_log('Entered with (%s,%s,%s,%s)',3,__FILE__,__LINE__,__METHOD__,
$server_id,$key,$index,$value);
if (! isset($this->default->$key))
pla_error("ERROR: Setting a key [$key] that isnt predefined.");
else
$default = $this->default->$key;
if (! isset($default[$index]))
pla_error("ERROR: Setting a index [$index] that isnt predefined.");
else
$default = $default[$index];
# Test if its should be an array or not.
if (is_array($default['default']) && ! is_array($value))
pla_error("Error in configuration file, {$key}['$index'] SHOULD be an array of values.");
if (! is_array($default['default']) && is_array($value))
pla_error("Error in configuration file, {$key}['$index'] should NOT be an array of values.");
# Some special processing.
# @todo: Add ldaps port details here.
if ($key == 'server') {
switch ($index) {
case 'host' :
if (strstr($value,'ldapi://'))
$this->_ldapservers[$server_id][$key]['port'] = false;
break;
}
}
$this->_ldapservers[$server_id][$key][$index] = $value;
}
function GetValue($server_id,$key,$index) {
if (isset($this->_ldapservers[$server_id][$key][$index]))
$return = $this->_ldapservers[$server_id][$key][$index];
else
$return = $this->default->{$key}[$index]['default'];
if (defined('DEBUG_ENABLED') && DEBUG_ENABLED)
debug_log('Entered with (%s,%s,%s), Returning (%s)',3,__FILE__,__LINE__,__METHOD__,
$server_id,$key,$index,$return);
return $return;
}
function GetServerList($onlyvisible=true) {
global $CACHE;
if (defined('DEBUG_ENABLED') && DEBUG_ENABLED)
debug_log('Entered with (%s)',3,__FILE__,__LINE__,__METHOD__,$onlyvisible);
if (! isset($CACHE['serverlist'])) {
$CACHE['serverlist'] = array();
foreach ($this->_ldapservers as $id => $ldapserver)
if (! $onlyvisible || ($onlyvisible && $this->GetValue($id,'appearance','visible')))
$CACHE['serverlist'][$id] = true;
} else {
if (defined('DEBUG_ENABLED') && DEBUG_ENABLED)
debug_log('Entered with (%s), Returning CACHED (%s)',3,__FILE__,__LINE__,__METHOD__,$onlyvisible,$CACHE['serverlist']);
return array_keys($CACHE['serverlist']);
}
if (defined('DEBUG_ENABLED') && DEBUG_ENABLED)
debug_log('Entered with (%s), Returning (%s)',3,__FILE__,__LINE__,__METHOD__,$onlyvisible,$CACHE['serverlist']);
return array_keys($CACHE['serverlist']);
}
function Instance($server_id=null) {
if (DEBUG_ENABLED)
debug_log('Entered with (%s)',3,__FILE__,__LINE__,__METHOD__,$server_id);
global $CACHE;
# If no server_id defined, then pick the lowest one.
if (is_null($server_id))
$server_id = min($this->GetServerList());
if (! isset($CACHE['instance'][$server_id])) {
if (DEBUG_ENABLED)
debug_log('New instance of server (%s)',3,__FILE__,__LINE__,__METHOD__,$server_id);
$instance = new LDAPserver($server_id);
foreach ($this->default as $key => $details) {
foreach ($details as $index => $value) {
if (isset($value['var']))
$instance->{$value['var']} = $this->GetValue($server_id,$key,$index);
}
}
$CACHE['instance'][$server_id] = $instance;
} else {
if (DEBUG_ENABLED)
debug_log('Returning CACHEd instance (%s)',3,__FILE__,__LINE__,__METHOD__,$server_id);
}
return $CACHE['instance'][$server_id];
}
}
?>